Overview
overview
7Static
static
3Feather La....1.exe
windows7-x64
6Feather La....1.exe
windows10-2004-x64
6$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...64.exe
windows7-x64
7$PLUGINSDI...64.exe
windows10-2004-x64
7$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3Feather Launcher.exe
windows7-x64
5Feather Launcher.exe
windows10-2004-x64
5LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...up.exe
windows7-x64
1resources/...up.exe
windows10-2004-x64
1resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows7-x64
3Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
Feather Launcher Setup 1.6.1.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
Feather Launcher Setup 1.6.1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240910-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/VC_redist.x64.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/VC_redist.x64.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Feather Launcher.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Feather Launcher.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
LICENSES.chromium.html
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
LICENSES.chromium.html
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
ffmpeg.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
libEGL.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral21
Sample
libEGL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
libGLESv2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral23
Sample
libGLESv2.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/native/cleanup.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/native/cleanup.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
Feather Launcher.exe
-
Size
145.0MB
-
MD5
9ef1ecce599882119c5a0715f66dcc55
-
SHA1
f6e57a26c0f353ae14302a0a08eed0b4d8946619
-
SHA256
4d5066af522559245d0479e7d4ccc69a7f07de88aad84638d06815a6f4ad31e0
-
SHA512
f18f2e8b8cdab11305a33fce817715ebaf9d81b1eb4015e19aa1de7b53cc230b78b7b25af6151bdc6ad67c3ce763f294f8b61ecbb254a6ac0a2baea2fc8f0a3c
-
SSDEEP
3145728:9FJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVlZ:9FF+MnHejtWPrMYQWXPQdP57obOO4C6p
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\International\Geo\Nation Feather Launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\International\Geo\Nation Feather Launcher.exe -
Loads dropped DLL 1 IoCs
pid Process 2728 Feather Launcher.exe -
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\feathermc\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Feather Launcher.exe\" \"%1\"" Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\feathermc Feather Launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\feathermc\URL Protocol Feather Launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\feathermc\ = "URL:feathermc" Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\feathermc\shell\open\command Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\feathermc\shell Feather Launcher.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\feathermc\shell\open Feather Launcher.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 Feather Launcher.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 Feather Launcher.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1948 Feather Launcher.exe 1936 Feather Launcher.exe 2428 Feather Launcher.exe 2428 Feather Launcher.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe Token: SeShutdownPrivilege 2428 Feather Launcher.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2856 2428 Feather Launcher.exe 28 PID 2428 wrote to memory of 2792 2428 Feather Launcher.exe 29 PID 2428 wrote to memory of 2792 2428 Feather Launcher.exe 29 PID 2428 wrote to memory of 2792 2428 Feather Launcher.exe 29 PID 2428 wrote to memory of 2728 2428 Feather Launcher.exe 30 PID 2428 wrote to memory of 2728 2428 Feather Launcher.exe 30 PID 2428 wrote to memory of 2728 2428 Feather Launcher.exe 30 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31 PID 2428 wrote to memory of 2256 2428 Feather Launcher.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1040 --field-trial-handle=1068,i,861785351687766470,10512502806487070590,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2856
-
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --mojo-platform-channel-handle=1288 --field-trial-handle=1068,i,861785351687766470,10512502806487070590,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:2792
-
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --disable-blink-features=GetDisplayMedia --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1512 --field-trial-handle=1068,i,861785351687766470,10512502806487070590,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-mod-watcher-fork.js3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948
-
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" C:\Users\Admin\AppData\Local\Temp\resources\app.asar\preload\preload-skin-watcher-fork.js3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1936
-
-
-
C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Feather Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Feather Launcher" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1040 --field-trial-handle=1068,i,861785351687766470,10512502806487070590,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57B
MD558127c59cb9e1da127904c341d15372b
SHA162445484661d8036ce9788baeaba31d204e9a5fc
SHA256be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA5128d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
-
Filesize
441KB
MD54604e676a0a7d18770853919e24ec465
SHA1415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f
SHA256a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
SHA5123d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
7.0MB
MD57c665f5be07c5c43fa97973838b6a8ce
SHA103a3d5c39fbe0c43fa1560ed63276d905b2b74e9
SHA2564b8df94e631f974b979086e9bc78395e3c95a813af55481dd2d89fc07ee64815
SHA512c36d241427f4f0ff8059d839288b0bb150c873a4f7f9d78816617efa74e4b59a7b27d219db224460ce9f1ecb874e2c89f9b75fb3ffb3e0c8720fd917610f9d1d