Overview
overview
3Static
static
3processlas...2).zip
windows11-21h2-x64
1processlas...rtable
windows11-21h2-x64
3processlas...er.exe
windows11-21h2-x64
1processlas...ts.exe
windows11-21h2-x64
1processlas...er.exe
windows11-21h2-x64
1processlas...er.exe
windows11-21h2-x64
1processlas...or.exe
windows11-21h2-x64
1processlas...so.exe
windows11-21h2-x64
1processlas...er.exe
windows11-21h2-x64
3processlas...de.exe
windows11-21h2-x64
1processlas...er.exe
windows11-21h2-x64
1processlas...er.exe
windows11-21h2-x64
1processlas...so.bat
windows11-21h2-x64
1processlas...ms.exe
windows11-21h2-x64
1processlas...te.exe
windows11-21h2-x64
1processlas...se.dll
windows11-21h2-x64
1processlas...al.dll
windows11-21h2-x64
1processlas...sh.dll
windows11-21h2-x64
1processlas...sh.dll
windows11-21h2-x64
1processlas...ch.dll
windows11-21h2-x64
1processlas...an.dll
windows11-21h2-x64
1processlas...an.dll
windows11-21h2-x64
1processlas...se.dll
windows11-21h2-x64
1processlas...sh.dll
windows11-21h2-x64
1processlas...br.dll
windows11-21h2-x64
1processlas...an.dll
windows11-21h2-x64
1processlas...sh.dll
windows11-21h2-x64
1processlas...ub.exe
windows11-21h2-x64
1processlas...or.bat
windows11-21h2-x64
1processlas...or.bat
windows11-21h2-x64
1processlas...so.exe
windows11-21h2-x64
1processlas...sc.exe
windows11-21h2-x64
1Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-06-2024 09:49
Static task
static1
Behavioral task
behavioral1
Sample
processlasso_portable_64 (2).zip
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
processlasso_portable_64/.portable
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
processlasso_portable_64/CPUEater.exe
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
processlasso_portable_64/Insights.exe
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
processlasso_portable_64/InstallHelper.exe
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
processlasso_portable_64/LogViewer.exe
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
processlasso_portable_64/ProcessGovernor.exe
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
processlasso_portable_64/ProcessLasso.exe
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
processlasso_portable_64/ProcessLassoLauncher.exe
Resource
win11-20240508-en
Behavioral task
behavioral10
Sample
processlasso_portable_64/QuickUpgrade.exe
Resource
win11-20240419-en
Behavioral task
behavioral11
Sample
processlasso_portable_64/ThreadRacer.exe
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
processlasso_portable_64/TweakScheduler.exe
Resource
win11-20240426-en
Behavioral task
behavioral13
Sample
processlasso_portable_64/_Start-ProcessLasso.bat
Resource
win11-20240426-en
Behavioral task
behavioral14
Sample
processlasso_portable_64/bitsumms.exe
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
processlasso_portable_64/plActivate.exe
Resource
win11-20240508-en
Behavioral task
behavioral16
Sample
processlasso_portable_64/pl_rsrc_chinese.dll
Resource
win11-20240426-en
Behavioral task
behavioral17
Sample
processlasso_portable_64/pl_rsrc_chinese_traditional.dll
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
processlasso_portable_64/pl_rsrc_english.dll
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
processlasso_portable_64/pl_rsrc_finnish.dll
Resource
win11-20240508-en
Behavioral task
behavioral20
Sample
processlasso_portable_64/pl_rsrc_french.dll
Resource
win11-20240426-en
Behavioral task
behavioral21
Sample
processlasso_portable_64/pl_rsrc_german.dll
Resource
win11-20240508-en
Behavioral task
behavioral22
Sample
processlasso_portable_64/pl_rsrc_italian.dll
Resource
win11-20240419-en
Behavioral task
behavioral23
Sample
processlasso_portable_64/pl_rsrc_japanese.dll
Resource
win11-20240508-en
Behavioral task
behavioral24
Sample
processlasso_portable_64/pl_rsrc_polish.dll
Resource
win11-20240508-en
Behavioral task
behavioral25
Sample
processlasso_portable_64/pl_rsrc_ptbr.dll
Resource
win11-20240426-en
Behavioral task
behavioral26
Sample
processlasso_portable_64/pl_rsrc_russian.dll
Resource
win11-20240426-en
Behavioral task
behavioral27
Sample
processlasso_portable_64/pl_rsrc_spanish.dll
Resource
win11-20240426-en
Behavioral task
behavioral28
Sample
processlasso_portable_64/srvstub.exe
Resource
win11-20240426-en
Behavioral task
behavioral29
Sample
processlasso_portable_64/start-governor.bat
Resource
win11-20240426-en
Behavioral task
behavioral30
Sample
processlasso_portable_64/stop-governor.bat
Resource
win11-20240426-en
Behavioral task
behavioral31
Sample
processlasso_portable_64/testlasso.exe
Resource
win11-20240426-en
Behavioral task
behavioral32
Sample
processlasso_portable_64/vistammsc.exe
Resource
win11-20240508-en
General
-
Target
processlasso_portable_64/ProcessLassoLauncher.exe
-
Size
378KB
-
MD5
3252e937a9c366f20097724d96738bfb
-
SHA1
5a1b3e0ae98a6dce8916121193fd87476047d657
-
SHA256
c566bd110f86608bfb3e6e8a19073a696632d0f306ebf6b54daeea49b771cc32
-
SHA512
40a8550c922edd0f4b1c6905cea9d356b6b40c5a186c8b8551498b8896c1212fdee1ff0be42bbd80577324023a1f7e75f3f160cb94a5b316aa92a5cd3a58993d
-
SSDEEP
6144:zTe/J1LANFniOHVqOPWQBID7pTTbFW8fP:qJANFniO1PFBID7p748fP
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
ProcessLassoLauncher.exedescription pid process target process PID 3768 wrote to memory of 3352 3768 ProcessLassoLauncher.exe ProcessLasso.exe PID 3768 wrote to memory of 3352 3768 ProcessLassoLauncher.exe ProcessLasso.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\ProcessLassoLauncher.exe"C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\ProcessLassoLauncher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\ProcessLasso.exe"C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\ProcessLasso.exe" "C:\Users\Admin\AppData\Local\Temp\processlasso_portable_64\ProcessLassoLauncher.exe"2⤵PID:3352