Overview

overview

8

Static

static

3

LetsVPN.exe

windows10-2004-x64

8

LetsVPN.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 14:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LetsVPN.exe
  • Size 30.4MB
  • Sample260701-repdfahz2y
  • SHA256 b40c805adee587f29be6f98e986b92b11a545122703ab4eaea4b0fa3c3e02483
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 56 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\LetsVPN.exe
    "C:\Users\Admin\AppData\Local\Temp\LetsVPN.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1316
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\6h45h\KL-2026 3.20.0.0\install\KL-2026.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\LetsVPN.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1782674070 "
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1648
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5944
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 10FECCDF61476B5E8054097C2ACEF423 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:792
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1544
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 78737BA63F81734C3481FEAF08711E06
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1672
      • C:\ProgramData\Lets\mesedge.exe
        "C:\ProgramData\Lets\mesedge.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:6140
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "MyAutoStartApp" /tr "C:\ProgramData\Lets\mesedge.exe" /sc onlogon /rl highest /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:5188
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\ProgramData\Lets
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:3416
      • C:\ProgramData\Lets\latst.exe
        "C:\ProgramData\Lets\latst.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4728
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:6000
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:6008
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1380
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2924

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59a060.rbs
          • Path C:\Config.Msi\e59a060.rbs
          • Size 1KB
          • SHA256 66696ab0686fe628f078772cb14c922e0162eb3d6cf38bc9b835d2092623731b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          cef_frame.dll
          • Path C:\ProgramData\Lets\cef_frame.dll
          • Size 8.8MB
          • SHA256 645fa91ec5149e5f571d1e55d2c68295a6cb33c2ecb69a23964976923aa4d83a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          latst.exe
          • Path C:\ProgramData\Lets\latst.exe
          • Size 16.7MB
          • SHA256 796640f54bdad0f8a77fdde41ef8d15bde06cc5e1d6920159ebd8ab06a0e4bc9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mesedge.exe
          • Path C:\ProgramData\Lets\mesedge.exe
          • Size 19KB
          • SHA256 10e990bbbda70da62c668908d0dbb4c9b21ffe95f186795c3a5ae98b5d302881
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI581A.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI581A.tmp
          • Size 719KB
          • SHA256 066c52ed8ebf63a33ab8290b7c58d0c13f79c14faa8bf12b1b41f643d3ebe281
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsbC51C.tmp\System.dll
          • Size 12KB
          • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsbC51C.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          KL-2026.msi
          • Path C:\Users\Admin\AppData\Roaming\6h45h\KL-2026 3.20.0.0\install\KL-2026.msi
          • Size 2.0MB
          • SHA256 e2e3158405986d5617b8308b38e266928e96e0b95432501c9af7ef8c935c3532
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          KL-20261.cab
          • Path C:\Users\Admin\AppData\Roaming\6h45h\KL-2026 3.20.0.0\install\KL-20261.cab
          • Size 24.5MB
          • SHA256 00265a99c497f030186b8ac38ad7e596c3ae7aa70e588d9b779080fc2ddda542
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIB4C5.tmp
          • Path C:\Windows\Installer\MSIB4C5.tmp
          • Size 835KB
          • SHA256 e6d18685b2e231f9166909764c3b90bbc3c51f30736d18873166e5dc9133e290
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 83310017ceabbb750469237cf9cedefe2d0944b85ff4bfa810118d3da10060b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {24ea8942-7dee-4bae-bdae-003de2acaee0}_OnDiskSnapshotProp
          • Path \??\Volume{0c051f61-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{24ea8942-7dee-4bae-bdae-003de2acaee0}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 1124bc2201f5e8c790665652d30cabac10dc2238037bc954a06b0408ed87f7af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2924-75-0x0000024882910000-0x0000024882930000-memory.dmp
          Download

          memory/2924-56-0x0000024882930000-0x0000024882950000-memory.dmp
          Download

          memory/2924-58-0x0000024882E70000-0x0000024882F70000-memory.dmp
          Download

          memory/2924-43-0x00000248801E0000-0x00000248802E0000-memory.dmp
          Download

          memory/2924-89-0x00000248941F0000-0x0000024894210000-memory.dmp
          Download

          memory/3416-288-0x00000000063A0000-0x00000000063BE000-memory.dmp
          Download

          memory/3416-294-0x0000000006980000-0x00000000069A0000-memory.dmp
          Download

          memory/3416-299-0x0000000007990000-0x0000000007A26000-memory.dmp
          Download

          memory/3416-280-0x0000000002B60000-0x0000000002B96000-memory.dmp
          Download

          memory/3416-281-0x00000000057A0000-0x0000000005DEA000-memory.dmp
          Download

          memory/3416-282-0x0000000005660000-0x0000000005682000-memory.dmp
          Download

          memory/3416-284-0x0000000005E60000-0x0000000005EC6000-memory.dmp
          Download

          memory/3416-283-0x0000000005DF0000-0x0000000005E56000-memory.dmp
          Download

          memory/3416-287-0x0000000005F40000-0x000000000629B000-memory.dmp
          Download

          memory/3416-298-0x0000000007790000-0x000000000779A000-memory.dmp
          Download

          memory/3416-289-0x00000000063F0000-0x000000000643C000-memory.dmp
          Download

          memory/3416-290-0x0000000007570000-0x00000000075A6000-memory.dmp
          Download

          memory/3416-291-0x0000000073F00000-0x0000000073F4C000-memory.dmp
          Download

          memory/3416-297-0x0000000007720000-0x000000000773A000-memory.dmp
          Download

          memory/3416-295-0x00000000075C0000-0x0000000007663000-memory.dmp
          Download

          memory/3416-296-0x0000000007D60000-0x00000000083DC000-memory.dmp
          Download

          memory/6008-277-0x000000000E010000-0x000000000E0DC000-memory.dmp
          Download

          memory/6140-268-0x0000000000D40000-0x0000000000D41000-memory.dmp
          Download

          memory/6140-269-0x0000000071AC0000-0x000000007238F000-memory.dmp
          Download