Analysis
- user interaction
yes - max time kernel
28s - max time network
20s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
erkb3lih.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
erkb3lih.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
erkb3lih.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
erkb3lih.exe
Resource
win11-20260911-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target erkb3lih.exe
- Size 61KB
- Sample261107-xbebyset6v
- SHA256 3bb2ec1e9f64af6e61df180ca08e8ca0d951311a337b602e98236bb4588f1827
- MD5 2f33b309dd0053752aa286e31848f68e
- SHA1 6627b5617fb2bd6406943947fdbc205e86bb6bab
- SHA512 5b30837ca0376c4e22ded5507d875ee904a6df54fa3cd58f66fcddb9a2bf4ca7885374c23a0a1a5ebcfc34d09c01cdede0d51d715732dbc97ddb09df49e0a589
- SSDEEP 1536:QSNEsI6JHMsv2KwXwhlpooY7KKoLjHflH:dCSJH9v2vXMlpoL7KX/l
- TLSH T19E53F61927FD5422F2BEC7BD68B41122C633B5F65935EF4A4ECD55882BA73005AC0B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions erkb3lih.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions erkb3lih.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools erkb3lih.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools erkb3lih.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion erkb3lih.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\erkb3lih = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erkb3lih.exe" erkb3lih.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\erkb3lih = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erkb3lih.exe" erkb3lih.exe - Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 15 discord.com 16 discord.com 17 discord.com 18 discord.com - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 erkb3lih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 erkb3lih.exe - Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 3420 wmic.exe 3460 wmic.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1396 netsh.exe 4388 netsh.exe - Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S erkb3lih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S erkb3lih.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName erkb3lih.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3420 wmic.exe 3420 wmic.exe 3420 wmic.exe 3420 wmic.exe 4632 erkb3lih.exe 3460 wmic.exe 3460 wmic.exe 3460 wmic.exe 3460 wmic.exe 5056 erkb3lih.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3420 wmic.exe Token: SeSecurityPrivilege 3420 wmic.exe Token: SeTakeOwnershipPrivilege 3420 wmic.exe Token: SeLoadDriverPrivilege 3420 wmic.exe Token: SeSystemProfilePrivilege 3420 wmic.exe Token: SeSystemtimePrivilege 3420 wmic.exe Token: SeProfSingleProcessPrivilege 3420 wmic.exe Token: SeIncBasePriorityPrivilege 3420 wmic.exe Token: SeCreatePagefilePrivilege 3420 wmic.exe Token: SeBackupPrivilege 3420 wmic.exe Token: SeRestorePrivilege 3420 wmic.exe Token: SeShutdownPrivilege 3420 wmic.exe Token: SeDebugPrivilege 3420 wmic.exe Token: SeSystemEnvironmentPrivilege 3420 wmic.exe Token: SeRemoteShutdownPrivilege 3420 wmic.exe Token: SeUndockPrivilege 3420 wmic.exe Token: SeManageVolumePrivilege 3420 wmic.exe Token: 33 3420 wmic.exe Token: 34 3420 wmic.exe Token: 35 3420 wmic.exe Token: 36 3420 wmic.exe Token: SeIncreaseQuotaPrivilege 3420 wmic.exe Token: SeSecurityPrivilege 3420 wmic.exe Token: SeTakeOwnershipPrivilege 3420 wmic.exe Token: SeLoadDriverPrivilege 3420 wmic.exe Token: SeSystemProfilePrivilege 3420 wmic.exe Token: SeSystemtimePrivilege 3420 wmic.exe Token: SeProfSingleProcessPrivilege 3420 wmic.exe Token: SeIncBasePriorityPrivilege 3420 wmic.exe Token: SeCreatePagefilePrivilege 3420 wmic.exe Token: SeBackupPrivilege 3420 wmic.exe Token: SeRestorePrivilege 3420 wmic.exe Token: SeShutdownPrivilege 3420 wmic.exe Token: SeDebugPrivilege 3420 wmic.exe Token: SeSystemEnvironmentPrivilege 3420 wmic.exe Token: SeRemoteShutdownPrivilege 3420 wmic.exe Token: SeUndockPrivilege 3420 wmic.exe Token: SeManageVolumePrivilege 3420 wmic.exe Token: 33 3420 wmic.exe Token: 34 3420 wmic.exe Token: 35 3420 wmic.exe Token: 36 3420 wmic.exe Token: SeDebugPrivilege 4632 erkb3lih.exe Token: SeIncreaseQuotaPrivilege 3460 wmic.exe Token: SeSecurityPrivilege 3460 wmic.exe Token: SeTakeOwnershipPrivilege 3460 wmic.exe Token: SeLoadDriverPrivilege 3460 wmic.exe Token: SeSystemProfilePrivilege 3460 wmic.exe Token: SeSystemtimePrivilege 3460 wmic.exe Token: SeProfSingleProcessPrivilege 3460 wmic.exe Token: SeIncBasePriorityPrivilege 3460 wmic.exe Token: SeCreatePagefilePrivilege 3460 wmic.exe Token: SeBackupPrivilege 3460 wmic.exe Token: SeRestorePrivilege 3460 wmic.exe Token: SeShutdownPrivilege 3460 wmic.exe Token: SeDebugPrivilege 3460 wmic.exe Token: SeSystemEnvironmentPrivilege 3460 wmic.exe Token: SeRemoteShutdownPrivilege 3460 wmic.exe Token: SeUndockPrivilege 3460 wmic.exe Token: SeManageVolumePrivilege 3460 wmic.exe Token: 33 3460 wmic.exe Token: 34 3460 wmic.exe Token: 35 3460 wmic.exe Token: 36 3460 wmic.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4632 wrote to memory of 3420 4632 erkb3lih.exe 89 PID 5056 wrote to memory of 3460 5056 erkb3lih.exe 94 PID 4632 wrote to memory of 1396 4632 erkb3lih.exe 96 PID 5056 wrote to memory of 4388 5056 erkb3lih.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\erkb3lih.exe"C:\Users\Admin\AppData\Local\Temp\erkb3lih.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1396
-
-
C:\Users\Admin\AppData\Local\Temp\erkb3lih.exeC:\Users\Admin\AppData\Local\Temp\erkb3lih.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4388
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Darkness-ADMIN.zip
- Size 425KB
- SHA256 db62d85654c39f21d8368e109329ff605372923ad18d6a0bf7410198507bae07
- MD5 c1e7d75ffc6eeda7e423367746ecbe92
- SHA1 6fc8114d0fde54178ca3941bf415993c585c5e82
- SHA512 8b40cd5460d4ce9a6e1c0ae2f2b3d7f2332b5f8c17d1f8f76e4c5bceee0eda60205b5ed1cd34a170831f5f2bf21e2e759fe95461bc0eb39c4fbcd38b69a3ffcf
- SSDEEP 12288:I6IyWbQfZX6m21MgKMb71Cy6JLGnzQmtcAJ+4eJMR:I6CbQxX6m21FqLGzttzOMR
- TLSH T1879423A28B68185C953B1336E816A5C052EE77C53C7F5B356FC8EF1A2523F49E2206F1
- MD5 SHA1 SHA512 SSDEEP TLSH