Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/07/2026, 12:24
General
- Target LetsVPN.exe
- Size 27.5MB
- Sample260704-plefpsfs9v
- SHA256 26c54b1a0cb5d8636966e6f27505035b2521c7733ee8827b21a9a76f934665e7
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops file in Drivers directory 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 64 IoCs
- Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 1 IoCs
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Drops file in System32 directory 16 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies data under HKEY_USERS 42 IoCs
- Modifies registry class 9 IoCs
- Modifies system certificate store 2 TTPs 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LetsVPN.exe"C:\Users\Admin\AppData\Local\Temp\LetsVPN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\letss\Microsoft.exe"C:\ProgramData\letss\Microsoft.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MyAutoStartApp" /tr "C:\ProgramData\letss\Microsoft.exe" /sc onlogon /rl highest /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\ProgramData\letss3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\ProgramData\letss\LetsPRO.exe"C:\ProgramData\letss\LetsPRO.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\letss\app-3.20.0\LetsPRO.exe"C:\ProgramData\letss\app-3.20.0\LetsPRO.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ""C:\ProgramData\letss\driver\tapinstall.exe" install "C:\ProgramData\letss\driver\oemVista.inf" tap0901"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\letss\driver\tapinstall.exe"C:\ProgramData\letss\driver\tapinstall.exe" install "C:\ProgramData\letss\driver\oemVista.inf" tap09015⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ipconfig /all4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all5⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C route print4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ROUTE.EXEroute print5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C arp -a4⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ARP.EXEarp -a5⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\ProgramData\letss\Microsoft.exeC:\ProgramData\letss\Microsoft.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{73efb582-b132-2748-a0c8-fb3640061fbb}\oemvista.inf" "9" "4d14a44ff" "00000000000000B8" "WinSta0\Default" "0000000000000150" "208" "c:\programdata\letss\driver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "00000000000000B8"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\letss\app-3.20.0\LetsPRO.exe"C:\ProgramData\letss\app-3.20.0\LetsPRO.exe" /silent1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
LetsPRO.exe
LetsPRO.ini
Microsoft.exe
VCRUNTIME140.dll
CommunityToolkit.Mvvm.dll
INIFileParser.dll
LetsGoogleAnalytics.dll
LetsPRO.exe
LetsPRO.exe.config
LetsVPNDomainModel.dll
LetsVPNInfraStructure.dll
Microsoft.Web.WebView2.Core.dll
Newtonsoft.Json.dll
Sentry.dll
System.Buffers.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Runtime.InteropServices.RuntimeInformation.dll
System.ValueTuple.dll
Utils.dll
libwin.dll
log4net.config
log4net.dll
WebView2Loader.dll
cef_frame.dll
__PSScriptPolicyTest_xy040r1g.pxs.ps1
SET2650.tmp
SET2660.tmp
SET2661.tmp
memory/1612-396-0x0000000001420000-0x0000000001421000-memory.dmp
memory/1612-395-0x0000000001410000-0x0000000001411000-memory.dmp
memory/1612-397-0x00000000718F0000-0x0000000072A4A000-memory.dmp
memory/1692-418-0x0000000054150000-0x0000000054182000-memory.dmp
memory/1692-534-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-330-0x0000000005D70000-0x0000000005D80000-memory.dmp
memory/1692-338-0x0000000006B50000-0x0000000006B76000-memory.dmp
memory/1692-334-0x0000000006B10000-0x0000000006B1A000-memory.dmp
memory/1692-566-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-567-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-355-0x0000000007360000-0x000000000788C000-memory.dmp
memory/1692-564-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-565-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-342-0x0000000006B20000-0x0000000006B28000-memory.dmp
memory/1692-329-0x0000000006AD0000-0x0000000006AE6000-memory.dmp
memory/1692-356-0x0000000006ED0000-0x0000000006EF2000-memory.dmp
memory/1692-324-0x0000000006930000-0x000000000694E000-memory.dmp
memory/1692-360-0x0000000006EA0000-0x0000000006EAC000-memory.dmp
memory/1692-325-0x0000000006970000-0x000000000698A000-memory.dmp
memory/1692-562-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-367-0x0000000007BD0000-0x0000000007BDE000-memory.dmp
memory/1692-319-0x0000000006350000-0x00000000066A4000-memory.dmp
memory/1692-318-0x0000000006320000-0x0000000006342000-memory.dmp
memory/1692-378-0x0000000051620000-0x00000000516B2000-memory.dmp
memory/1692-563-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-560-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-317-0x0000000006260000-0x0000000006312000-memory.dmp
memory/1692-561-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-392-0x0000000051F20000-0x0000000051F28000-memory.dmp
memory/1692-558-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-559-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-311-0x0000000005E30000-0x0000000005E96000-memory.dmp
memory/1692-310-0x0000000005D80000-0x0000000005E22000-memory.dmp
memory/1692-306-0x0000000005D70000-0x0000000005D80000-memory.dmp
memory/1692-401-0x0000000051A80000-0x0000000051A8E000-memory.dmp
memory/1692-400-0x0000000051AA0000-0x0000000051AD8000-memory.dmp
memory/1692-556-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-557-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-417-0x00000000540C0000-0x0000000054142000-memory.dmp
memory/1692-305-0x0000000005C20000-0x0000000005C2A000-memory.dmp
memory/1692-420-0x00000000541B0000-0x00000000541C6000-memory.dmp
memory/1692-423-0x00000000541F0000-0x0000000054202000-memory.dmp
memory/1692-422-0x00000000541A0000-0x00000000541AA000-memory.dmp
memory/1692-421-0x0000000054190000-0x000000005419A000-memory.dmp
memory/1692-416-0x0000000054010000-0x00000000540C0000-memory.dmp
memory/1692-301-0x0000000005C60000-0x0000000005CA6000-memory.dmp
memory/1692-554-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-555-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-552-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-553-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-550-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-551-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-548-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-297-0x0000000003320000-0x0000000003346000-memory.dmp
memory/1692-292-0x0000000000D50000-0x0000000000F16000-memory.dmp
memory/1692-549-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-546-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-479-0x0000000005D70000-0x0000000005D80000-memory.dmp
memory/1692-547-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-544-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-545-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-495-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-536-0x0000000006C50000-0x0000000006C62000-memory.dmp
memory/1692-494-0x000000006BFF0000-0x000000006CD76000-memory.dmp
memory/1692-505-0x0000000056BA0000-0x0000000057144000-memory.dmp
memory/1692-506-0x0000000055390000-0x00000000553DA000-memory.dmp
memory/1692-507-0x0000000005D70000-0x0000000005D80000-memory.dmp
memory/1692-508-0x0000000055C90000-0x0000000055CDC000-memory.dmp
memory/1692-509-0x0000000057170000-0x000000005718E000-memory.dmp
memory/1692-517-0x0000000057C70000-0x0000000057D13000-memory.dmp
memory/1692-526-0x0000000057F10000-0x0000000057F21000-memory.dmp
memory/1692-537-0x0000000005400000-0x000000000540A000-memory.dmp
memory/1692-528-0x0000000055D50000-0x0000000055D60000-memory.dmp
memory/1692-529-0x0000000057220000-0x000000005725A000-memory.dmp
memory/1692-530-0x00000000571F0000-0x00000000571F8000-memory.dmp
memory/1692-531-0x0000000057200000-0x0000000057210000-memory.dmp
memory/1692-532-0x0000000057280000-0x000000005729E000-memory.dmp
memory/1692-533-0x0000000057270000-0x0000000057278000-memory.dmp
memory/1692-535-0x000000006AE70000-0x000000006B630000-memory.dmp
memory/1692-346-0x0000000006B40000-0x0000000006B4A000-memory.dmp
memory/1692-538-0x0000000006C90000-0x0000000006CA6000-memory.dmp
memory/2736-285-0x0000000000400000-0x00000000004B8000-memory.dmp
memory/3404-402-0x0000000006D00000-0x0000000006D32000-memory.dmp
memory/3404-382-0x0000000002E10000-0x0000000002E46000-memory.dmp
memory/3404-486-0x0000000007DA0000-0x0000000007DBA000-memory.dmp
memory/3404-485-0x0000000007CA0000-0x0000000007CB4000-memory.dmp
memory/3404-474-0x0000000007C90000-0x0000000007C9E000-memory.dmp
memory/3404-411-0x0000000007920000-0x000000000793E000-memory.dmp
memory/3404-438-0x0000000007C60000-0x0000000007C71000-memory.dmp
memory/3404-437-0x0000000007CE0000-0x0000000007D76000-memory.dmp
memory/3404-427-0x0000000007AD0000-0x0000000007ADA000-memory.dmp
memory/3404-425-0x0000000007A60000-0x0000000007A7A000-memory.dmp
memory/3404-424-0x00000000080A0000-0x000000000871A000-memory.dmp
memory/3404-403-0x0000000068E20000-0x0000000068E6C000-memory.dmp
memory/3404-491-0x0000000007D80000-0x0000000007D88000-memory.dmp
memory/3404-383-0x00000000059F0000-0x0000000006018000-memory.dmp
memory/3404-412-0x0000000007940000-0x00000000079E3000-memory.dmp
memory/3404-394-0x0000000006780000-0x00000000067CC000-memory.dmp
memory/3404-393-0x0000000006730000-0x000000000674E000-memory.dmp
memory/3404-390-0x0000000006190000-0x00000000061F6000-memory.dmp
memory/4052-348-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/4052-527-0x00000000718F0000-0x0000000072A4A000-memory.dmp
memory/4052-320-0x000000007190F000-0x0000000071F25000-memory.dmp
memory/4052-496-0x000000007190F000-0x0000000071F25000-memory.dmp
memory/4052-354-0x00000000718F0000-0x0000000072A4A000-memory.dmp
memory/4052-349-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/4052-351-0x00000000718F1000-0x0000000071906000-memory.dmp