Overview
overview
6Static
static
3processlas...64.exe
windows10-2004-x64
4processlas...64.exe
windows11-21h2-x64
4$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDIR/INetC.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3CPUEater.exe
windows10-2004-x64
1CPUEater.exe
windows11-21h2-x64
1Insights.exe
windows10-2004-x64
1Insights.exe
windows11-21h2-x64
1InstallHelper.exe
windows10-2004-x64
1InstallHelper.exe
windows11-21h2-x64
1LogViewer.exe
windows10-2004-x64
1LogViewer.exe
windows11-21h2-x64
1ProcessGovernor.exe
windows10-2004-x64
1ProcessGovernor.exe
windows11-21h2-x64
1ProcessLasso.exe
windows10-2004-x64
1ProcessLasso.exe
windows11-21h2-x64
1ProcessLas...er.exe
windows10-2004-x64
5ProcessLas...er.exe
windows11-21h2-x64
3QuickUpgrade.exe
windows10-2004-x64
6QuickUpgrade.exe
windows11-21h2-x64
4ThreadRacer.exe
windows10-2004-x64
1ThreadRacer.exe
windows11-21h2-x64
1TweakScheduler.exe
windows10-2004-x64
1TweakScheduler.exe
windows11-21h2-x64
1bitsumsess...nt.exe
windows10-2004-x64
1bitsumsess...nt.exe
windows11-21h2-x64
1pl-update.cmd
windows10-2004-x64
1pl-update.cmd
windows11-21h2-x64
1Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 17:29
Static task
static1
Behavioral task
behavioral1
Sample
processlassosetup64.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
processlassosetup64.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
CPUEater.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
CPUEater.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
Insights.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Insights.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
InstallHelper.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
InstallHelper.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
LogViewer.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
LogViewer.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
ProcessGovernor.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
ProcessGovernor.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
ProcessLasso.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
ProcessLasso.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
ProcessLassoLauncher.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
ProcessLassoLauncher.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
QuickUpgrade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
QuickUpgrade.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
ThreadRacer.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
ThreadRacer.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
TweakScheduler.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
TweakScheduler.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
bitsumsessionagent.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
bitsumsessionagent.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
pl-update.cmd
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
pl-update.cmd
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target CPUEater.exe
- Size 553KB
- Sample260420-v2verac13x
- SHA256 ba69053cce7cee09c6261a2a8fbf1b9f53d13a11502fcd87cc7abc36c4c301a2
- MD5 99c42572fa391db9c94ec7bcec3e0bca
- SHA1 92f4504da0c6cfb5886486d367436aebe00514a7
- SHA512 e3166088a7b791ef7847fbda1ff26a8c0bb9109e3e3398bf4b13637b604d7474cf673225edc62324ac117434e3e3618a66e3443386953e657738726a963dcc0c
- SSDEEP 12288:4WIB9rbsr6eSKom+w5nH+uNcgQfs49FtH1:4WIBhPpw5H+uNcgf49jH1
- TLSH T140C48D94B2A481F9D0BBC239C9934406F9317C4157359ADF03D48AFA1F37AD58E3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 testlasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CPUEater.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CPUEater.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 testlasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 testlasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CPUEater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString testlasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 testlasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString testlasso.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CPUEater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString testlasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CPUEater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CPUEater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CPUEater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CPUEater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString CPUEater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString testlasso.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 CPUEater.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe 792 CPUEater.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 792 wrote to memory of 1660 792 CPUEater.exe 80 PID 1660 wrote to memory of 4880 1660 CPUEater.exe 81 PID 792 wrote to memory of 4652 792 CPUEater.exe 82 PID 4652 wrote to memory of 3292 4652 CPUEater.exe 83 PID 792 wrote to memory of 3304 792 CPUEater.exe 84 PID 3304 wrote to memory of 2336 3304 CPUEater.exe 85 PID 792 wrote to memory of 1948 792 CPUEater.exe 86 PID 1948 wrote to memory of 2340 1948 CPUEater.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\CPUEater.exe"C:\Users\Admin\AppData\Local\Temp\CPUEater.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\CPUEater.exe"C:\Users\Admin\AppData\Local\Temp\CPUEater.exe" /launchtest -c 30 -n 2 -a 02⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\testlasso.exe"C:\Users\Admin\AppData\Local\Temp\testlasso.exe" -c 30 -n 2 -a 03⤵
- Checks processor information in registry
PID:4880
-
-
-
C:\Users\Admin\AppData\Local\Temp\CPUEater.exe"C:\Users\Admin\AppData\Local\Temp\CPUEater.exe" /launchtest -c 30 -n 2 -a 02⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\testlasso.exe"C:\Users\Admin\AppData\Local\Temp\testlasso.exe" -c 30 -n 2 -a 03⤵
- Checks processor information in registry
PID:3292
-
-
-
C:\Users\Admin\AppData\Local\Temp\CPUEater.exe"C:\Users\Admin\AppData\Local\Temp\CPUEater.exe" /launchtest -c 30 -n 2 -a 02⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\testlasso.exe"C:\Users\Admin\AppData\Local\Temp\testlasso.exe" -c 30 -n 2 -a 03⤵
- Checks processor information in registry
PID:2336
-
-
-
C:\Users\Admin\AppData\Local\Temp\CPUEater.exe"C:\Users\Admin\AppData\Local\Temp\CPUEater.exe" /launchtest -c 30 -n 2 -a 02⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\testlasso.exe"C:\Users\Admin\AppData\Local\Temp\testlasso.exe" -c 30 -n 2 -a 03⤵
- Checks processor information in registry
PID:2340
-
-