erbium | 448ae75ea4f708984eec8f7d2d5912540893864b25b93aadc6449462892fd8ff

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_448ae75ea4f708984eec8f7d2d5912540893864b25b93aadc6449462892fd8ff.exe
Size 878KB
Sample261016-jd1fbage36
SHA256 448ae75ea4f708984eec8f7d2d5912540893864b25b93aadc6449462892fd8ff
MD5 a23b1918cfe0d91013cbaf1452c1d63f
SHA1 8fb45527f5c180179ea276ccb7dee5d074f8ee5e
SHA512 8d5ad3c9e816de345b323a4987bf68da3f3b20535602e85265437fee55b490c287c69f5bc5ccfeba9b76fcb150e76a455771a5bc267da9c6be2ffb35f2556044
SSDEEP 24576:UkM9pPmI1CGbyKhUPv4aQh53sw36iZPx7+nL:wV4otaw2M7A
TLSH
T1A715F1832590817BEE61C0FC6895D690097F8321F6E291A721DB27AF6CFB8D06574B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery erbium stealer

Malware Config

Extracted

Family

erbium

77.73.133.53

Signatures

Family: Erbium
Erbium is an infostealer written in C++ and first seen in July 2022.
stealer erbium
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5224 set thread context of 2428	5224	jaffacakes118_448ae75ea4f708984eec8f7d2d5912540893864b25b93aadc6449462892fd8ff.exe	90

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1456	2428	WerFault.exe	90
3744	2428	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_448ae75ea4f708984eec8f7d2d5912540893864b25b93aadc6449462892fd8ff.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 2428	5224	jaffacakes118_448ae75ea4f708984eec8f7d2d5912540893864b25b93aadc6449462892fd8ff.exe	90
PID 5224 wrote to memory of 2428	5224	jaffacakes118_448ae75ea4f708984eec8f7d2d5912540893864b25b93aadc6449462892fd8ff.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_448ae75ea4f708984eec8f7d2d5912540893864b25b93aadc6449462892fd8ff.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_448ae75ea4f708984eec8f7d2d5912540893864b25b93aadc6449462892fd8ff.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1288
    3⤵
    - Program crash
    PID:1456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 1344
    3⤵
    - Program crash
    PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2428 -ip 2428
1⤵
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2428 -ip 2428
1⤵
PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-0-0x0000000000400000-0x00000000004CA000-memory.dmp

Download

memory/2428-6-0x0000000000400000-0x00000000004CA000-memory.dmp