File name:

processlassosetup64.exe

Full analysis: https://app.any.run/tasks/950d7fea-5225-4f85-a124-8053db8b51ef
Verdict: Malicious activity
Analysis date: September 04, 2018, 17:04:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

8C991A6B871EA97E745985DFAD1ECC12

SHA1:

9BEE243729C8FDCE6A3936AC22C13D6789E4DA26

SHA256:

F8A291F4ACC0091679F9910D91A1F59B3C470A79512FDB5D3B7535D75F00865D

SSDEEP:

49152:YUrg4r5ddIKYmM8nZWZcqIU5oI4cZ64SU1Z00Y2:YUrdddlbJneh3rz0m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • processlassosetup64.exe (PID: 3072)
      • processlassosetup32.exe (PID: 3316)
      • installhelper.exe (PID: 3760)
      • installHelper.exe (PID: 3740)
      • installHelper.exe (PID: 2336)
      • InstallHelper.exe (PID: 2320)
      • InstallHelper.exe (PID: 956)
      • installhelper.exe (PID: 2420)
      • processgovernor.exe (PID: 3420)
      • processlasso.exe (PID: 2952)
      • InstallHelper.exe (PID: 2440)

    • Application was dropped or rewritten from another process

      • processlassosetup32.exe (PID: 3316)
      • installhelper.exe (PID: 3760)
      • installHelper.exe (PID: 3740)
      • InstallHelper.exe (PID: 2320)
      • bitsumms.exe (PID: 620)
      • bitsumms.exe (PID: 3320)
      • bitsumms.exe (PID: 3420)
      • bitsumms.exe (PID: 2672)
      • InstallHelper.exe (PID: 956)
      • bitsumms.exe (PID: 3056)
      • installhelper.exe (PID: 2420)
      • bitsumms.exe (PID: 3692)
      • processgovernor.exe (PID: 3420)
      • bitsumms.exe (PID: 2588)
      • bitsumms.exe (PID: 2744)
      • bitsumms.exe (PID: 1708)
      • bitsumms.exe (PID: 3400)
      • processlasso.exe (PID: 2952)
      • bitsumms.exe (PID: 2924)
      • bitsumms.exe (PID: 3256)
      • installHelper.exe (PID: 2336)
      • InstallHelper.exe (PID: 2440)

    • Changes settings of System certificates

      • processlassosetup64.exe (PID: 3072)

    • Loads the Task Scheduler COM API

      • InstallHelper.exe (PID: 2320)
      • installhelper.exe (PID: 2420)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • processlassosetup64.exe (PID: 3072)
      • processlassosetup32.exe (PID: 3316)

    • Creates files in the program directory

      • processlassosetup64.exe (PID: 3072)
      • processlassosetup32.exe (PID: 3316)
      • installhelper.exe (PID: 2420)

    • Adds / modifies Windows certificates

      • processlassosetup64.exe (PID: 3072)

    • Creates a software uninstall entry

      • processlassosetup32.exe (PID: 3316)

    • Creates files in the user directory

      • processgovernor.exe (PID: 3420)
      • installhelper.exe (PID: 2420)

  • INFO

    • Dropped object may contain URL's

      • processlassosetup64.exe (PID: 3072)
      • processlassosetup32.exe (PID: 3316)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:12:11 22:50:45+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 118784
UninitializedDataSize: 1024
EntryPoint: 0x32bf
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.0.0.478
ProductVersionNumber: 9.0.0.478
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
Comments: Windows process priority, CPU affinity, and process automation software
CompanyName: Bitsum LLC
FileDescription: Process Lasso
FileVersion: 9.0.0.478
LegalCopyright: (c)2018 Bitsum LLC
LegalTrademarks: Process Lasso is a trademark of Bitsum LLC
ProductName: Process Lasso

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Dec-2016 21:50:45
Detected languages:
  • English - United States
Comments: Windows process priority, CPU affinity, and process automation software
CompanyName: Bitsum LLC
FileDescription: Process Lasso
FileVersion: 9.0.0.478
LegalCopyright: (c)2018 Bitsum LLC
LegalTrademarks: Process Lasso is a trademark of Bitsum LLC
ProductName: Process Lasso

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 11-Dec-2016 21:50:45
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005E59
0x00006000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.42419
.rdata
0x00007000
0x00001246
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.0004
.data
0x00009000
0x0001A818
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.21193
.ndata
0x00024000
0x00018000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0003C000
0x0003AF48
0x0003B000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.38288

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28813
1070
UNKNOWN
English - United States
RT_MANIFEST
2
5.47747
12840
UNKNOWN
English - United States
RT_ICON
3
5.51132
7336
UNKNOWN
English - United States
RT_ICON
4
5.6438
3240
UNKNOWN
English - United States
RT_ICON
5
4.00617
1128
UNKNOWN
English - United States
RT_ICON
6
0
744
UNKNOWN
English - United States
RT_ICON
7
0
296
UNKNOWN
English - United States
RT_ICON
102
2.71813
180
UNKNOWN
English - United States
RT_DIALOG
103
2.80765
104
UNKNOWN
English - United States
RT_GROUP_ICON
104
2.70411
344
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
24
Malicious processes
5
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start processlassosetup64.exe processlassosetup32.exe installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs installhelper.exe no specs bitsumms.exe no specs bitsumms.exe no specs bitsumms.exe no specs bitsumms.exe no specs installhelper.exe no specs installhelper.exe no specs bitsumms.exe no specs bitsumms.exe no specs bitsumms.exe no specs bitsumms.exe no specs bitsumms.exe no specs bitsumms.exe no specs bitsumms.exe no specs bitsumms.exe no specs processlasso.exe no specs processgovernor.exe no specs processlassosetup64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
620"C:\Program Files\Process Lasso\bitsumms.exe" /name:ProcessGovernor /stopC:\Program Files\Process Lasso\bitsumms.exe—InstallHelper.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
MakeService - Bitsum Helper Application
Exit code:
1060
Version:
Modules
Images
c:\program files\process lasso\bitsumms.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft-windows-u..rsalcrt-apifwd-win7_31bf3856ad364e35_6.1.7601.18972_none_4d8675c06cc24030\api-ms-win-core-synch-l1-2-0.dll
956"C:\Program Files\Process Lasso\InstallHelper.exe" /enable_update_check"C:\Program Files\Process Lasso\InstallHelper.exe—processlassosetup32.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
Process Lasso Install Assistant
Exit code:
1
Version:
Modules
Images
c:\program files\process lasso\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1708"C:\Program Files\Process Lasso\bitsumms.exe" /name:ProcessGovernor /stopC:\Program Files\Process Lasso\bitsumms.exe—installhelper.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
MakeService - Bitsum Helper Application
Exit code:
1060
Version:
Modules
Images
c:\program files\process lasso\bitsumms.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft-windows-u..rsalcrt-apifwd-win7_31bf3856ad364e35_6.1.7601.18972_none_4d8675c06cc24030\api-ms-win-core-synch-l1-2-0.dll
2320"C:\Program Files\Process Lasso\InstallHelper.exe" /install"C:\Program Files\Process Lasso\InstallHelper.exe—processlassosetup32.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
Process Lasso Install Assistant
Exit code:
0
Version:
Modules
Images
c:\program files\process lasso\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2336"C:\Program Files\Process Lasso\installHelper.exe" /migrate"C:\Program Files\Process Lasso\installHelper.exe—processlassosetup32.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
Process Lasso Install Assistant
Exit code:
0
Version:
Modules
Images
c:\program files\process lasso\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2420"C:\Program Files\Process Lasso\installhelper.exe"C:\Program Files\Process Lasso\installhelper.exe—processlassosetup32.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
Process Lasso Install Assistant
Exit code:
0
Version:
Modules
Images
c:\program files\process lasso\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2440"C:\Program Files\Process Lasso\InstallHelper.exe" /powerinstall"C:\Program Files\Process Lasso\InstallHelper.exe—processlassosetup32.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
Process Lasso Install Assistant
Exit code:
0
Version:
Modules
Images
c:\program files\process lasso\installhelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2588"C:\Program Files\Process Lasso\bitsumms.exe" /name:ProcessGovernor /stopC:\Program Files\Process Lasso\bitsumms.exe—installhelper.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
MakeService - Bitsum Helper Application
Exit code:
1060
Version:
Modules
Images
c:\program files\process lasso\bitsumms.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft-windows-u..rsalcrt-apifwd-win7_31bf3856ad364e35_6.1.7601.18972_none_4d8675c06cc24030\api-ms-win-core-synch-l1-2-0.dll
2672"C:\Program Files\Process Lasso\bitsumms.exe" /name:ProcessGovernor /removeC:\Program Files\Process Lasso\bitsumms.exe—InstallHelper.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
MakeService - Bitsum Helper Application
Exit code:
1060
Version:
Modules
Images
c:\program files\process lasso\bitsumms.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft-windows-u..rsalcrt-apifwd-win7_31bf3856ad364e35_6.1.7601.18972_none_4d8675c06cc24030\api-ms-win-core-synch-l1-2-0.dll
2744"C:\Program Files\Process Lasso\bitsumms.exe" /name:ProcessLassoGovernor /removeC:\Program Files\Process Lasso\bitsumms.exe—installhelper.exe
User:
admin
Company:
Bitsum LLC
Integrity Level:
HIGH
Description:
MakeService - Bitsum Helper Application
Exit code:
1060
Version:
Modules
Images
c:\program files\process lasso\bitsumms.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft-windows-u..rsalcrt-apifwd-win7_31bf3856ad364e35_6.1.7601.18972_none_4d8675c06cc24030\api-ms-win-core-synch-l1-2-0.dll
Total events
873
Read events
606
Write events
267
Delete events
0

Modification events

(PID) Process:(3072) processlassosetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ProcessLasso
Operation:writeName:ConfigFileEx
Value:
MigratingConfigPath
(PID) Process:(3072) processlassosetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ProcessLasso\Language
Operation:writeName:ProcessLasso
Value:
0
(PID) Process:(3072) processlassosetup64.exeKey:HKEY_CURRENT_USER\Software\ProcessLasso\Language
Operation:writeName:ProcessLasso
Value:
0
(PID) Process:(3072) processlassosetup64.exeKey:HKEY_CURRENT_USER\Software\ProcessLasso
Operation:writeName:InstallerLanguageDWORD
Value:
1033
(PID) Process:(3072) processlassosetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Bitsum
Operation:writeName:Language
Value:
1033
(PID) Process:(3072) processlassosetup64.exeKey:HKEY_CURRENT_USER\Software\Bitsum
Operation:writeName:Language
Value:
1033
(PID) Process:(3072) processlassosetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\processlassosetup64_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3072) processlassosetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\processlassosetup64_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3072) processlassosetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\processlassosetup64_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3072) processlassosetup64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\processlassosetup64_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
36
Suspicious files
2
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
3072processlassosetup64.exeC:\Users\admin\AppData\Local\Temp\nsp78D8.tmp —
MD5:—
SHA256:—
3316processlassosetup32.exeC:\Program Files\Process Lasso\InstallHelper.exeexecutable
MD5:—
SHA256:—
3072processlassosetup64.exeC:\Program Files\Process Lasso\InstallHelper.exeexecutable
MD5:—
SHA256:—
3072processlassosetup64.exeC:\Users\admin\AppData\Local\Temp\processlassosetup32.exeexecutable
MD5:—
SHA256:—
3316processlassosetup32.exeC:\Program Files\Process Lasso\pl_rsrc_english.dllexecutable
MD5:—
SHA256:—
3316processlassosetup32.exeC:\Program Files\Process Lasso\bitsumms.exeexecutable
MD5:—
SHA256:—
3072processlassosetup64.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHUAAB7W\processlassosetup32[1].exeexecutable
MD5:—
SHA256:—
3316processlassosetup32.exeC:\Users\admin\AppData\Local\Temp\nsbA23B.tmp\LangDLL.dllexecutable
MD5:B26B412D9F1050AD53F663C972FDCD9F
SHA256:70C842F318F691D92E5829616A283AA9BF9DC18CEA6F39BAD028E176056B591A
3072processlassosetup64.exeC:\Users\admin\AppData\Local\Temp\nsf78E9.tmp\INetC.dllexecutable
MD5:92EC4DD8C0DDD8C4305AE1684AB65FB0
SHA256:5520208A33E6409C129B4EA1270771F741D95AFE5B048C2A1E6A2CC2AD829934
3316processlassosetup32.exeC:\Program Files\Process Lasso\QuickUpgrade.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3072
processlassosetup64.exe
208.101.2.146:443
bitsum.com
SoftLayer Technologies Inc.
US
unknown

DNS requests

Domain
IP
Reputation
bitsum.com
  • 208.101.2.146
whitelisted
at.bitsum.com
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
processlassosetup64.exe