Analysis
- user interaction
yes - max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
erkb3lih.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
erkb3lih.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
erkb3lih.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
erkb3lih.exe
Resource
win11-20260911-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target erkb3lih.exe
- Size 61KB
- Sample261107-xbebyset6v
- SHA256 3bb2ec1e9f64af6e61df180ca08e8ca0d951311a337b602e98236bb4588f1827
- MD5 2f33b309dd0053752aa286e31848f68e
- SHA1 6627b5617fb2bd6406943947fdbc205e86bb6bab
- SHA512 5b30837ca0376c4e22ded5507d875ee904a6df54fa3cd58f66fcddb9a2bf4ca7885374c23a0a1a5ebcfc34d09c01cdede0d51d715732dbc97ddb09df49e0a589
- SSDEEP 1536:QSNEsI6JHMsv2KwXwhlpooY7KKoLjHflH:dCSJH9v2vXMlpoL7KX/l
- TLSH T19E53F61927FD5422F2BEC7BD68B41122C633B5F65935EF4A4ECD55882BA73005AC0B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions erkb3lih.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions erkb3lih.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools erkb3lih.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools erkb3lih.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion erkb3lih.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erkb3lih = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erkb3lih.exe" erkb3lih.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erkb3lih = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erkb3lih.exe" erkb3lih.exe - Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 14 discord.com 15 discord.com 16 discord.com 17 discord.com 18 discord.com - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 erkb3lih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 erkb3lih.exe - Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 376 wmic.exe 4016 wmic.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4352 netsh.exe 1208 netsh.exe - Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S erkb3lih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S erkb3lih.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName erkb3lih.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2464 erkb3lih.exe 3120 erkb3lih.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 376 wmic.exe Token: SeSecurityPrivilege 376 wmic.exe Token: SeTakeOwnershipPrivilege 376 wmic.exe Token: SeLoadDriverPrivilege 376 wmic.exe Token: SeSystemProfilePrivilege 376 wmic.exe Token: SeSystemtimePrivilege 376 wmic.exe Token: SeProfSingleProcessPrivilege 376 wmic.exe Token: SeIncBasePriorityPrivilege 376 wmic.exe Token: SeCreatePagefilePrivilege 376 wmic.exe Token: SeBackupPrivilege 376 wmic.exe Token: SeRestorePrivilege 376 wmic.exe Token: SeShutdownPrivilege 376 wmic.exe Token: SeDebugPrivilege 376 wmic.exe Token: SeSystemEnvironmentPrivilege 376 wmic.exe Token: SeRemoteShutdownPrivilege 376 wmic.exe Token: SeUndockPrivilege 376 wmic.exe Token: SeManageVolumePrivilege 376 wmic.exe Token: 33 376 wmic.exe Token: 34 376 wmic.exe Token: 35 376 wmic.exe Token: 36 376 wmic.exe Token: SeIncreaseQuotaPrivilege 376 wmic.exe Token: SeSecurityPrivilege 376 wmic.exe Token: SeTakeOwnershipPrivilege 376 wmic.exe Token: SeLoadDriverPrivilege 376 wmic.exe Token: SeSystemProfilePrivilege 376 wmic.exe Token: SeSystemtimePrivilege 376 wmic.exe Token: SeProfSingleProcessPrivilege 376 wmic.exe Token: SeIncBasePriorityPrivilege 376 wmic.exe Token: SeCreatePagefilePrivilege 376 wmic.exe Token: SeBackupPrivilege 376 wmic.exe Token: SeRestorePrivilege 376 wmic.exe Token: SeShutdownPrivilege 376 wmic.exe Token: SeDebugPrivilege 376 wmic.exe Token: SeSystemEnvironmentPrivilege 376 wmic.exe Token: SeRemoteShutdownPrivilege 376 wmic.exe Token: SeUndockPrivilege 376 wmic.exe Token: SeManageVolumePrivilege 376 wmic.exe Token: 33 376 wmic.exe Token: 34 376 wmic.exe Token: 35 376 wmic.exe Token: 36 376 wmic.exe Token: SeDebugPrivilege 2464 erkb3lih.exe Token: SeIncreaseQuotaPrivilege 4016 wmic.exe Token: SeSecurityPrivilege 4016 wmic.exe Token: SeTakeOwnershipPrivilege 4016 wmic.exe Token: SeLoadDriverPrivilege 4016 wmic.exe Token: SeSystemProfilePrivilege 4016 wmic.exe Token: SeSystemtimePrivilege 4016 wmic.exe Token: SeProfSingleProcessPrivilege 4016 wmic.exe Token: SeIncBasePriorityPrivilege 4016 wmic.exe Token: SeCreatePagefilePrivilege 4016 wmic.exe Token: SeBackupPrivilege 4016 wmic.exe Token: SeRestorePrivilege 4016 wmic.exe Token: SeShutdownPrivilege 4016 wmic.exe Token: SeDebugPrivilege 4016 wmic.exe Token: SeSystemEnvironmentPrivilege 4016 wmic.exe Token: SeRemoteShutdownPrivilege 4016 wmic.exe Token: SeUndockPrivilege 4016 wmic.exe Token: SeManageVolumePrivilege 4016 wmic.exe Token: 33 4016 wmic.exe Token: 34 4016 wmic.exe Token: 35 4016 wmic.exe Token: 36 4016 wmic.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2464 wrote to memory of 376 2464 erkb3lih.exe 85 PID 3120 wrote to memory of 4016 3120 erkb3lih.exe 90 PID 2464 wrote to memory of 4352 2464 erkb3lih.exe 92 PID 3120 wrote to memory of 1208 3120 erkb3lih.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\erkb3lih.exe"C:\Users\Admin\AppData\Local\Temp\erkb3lih.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4352
-
-
C:\Users\Admin\AppData\Local\Temp\erkb3lih.exeC:\Users\Admin\AppData\Local\Temp\erkb3lih.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1208
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\erkb3lih.exe.log
- Size 1KB
- SHA256 120c594801e1156af3ecba9aefe96f79db2e0db56c2acf0f7929a2796a6d960f
- MD5 ef47ca1ae7f3dc73208d76d2930601f2
- SHA1 2abf7d30f8b9888f5576a218ac1ae84d3a6cf691
- SHA512 1988d7b767dc1c5edafc1b751d86c6d35fb4513924090619cad4eeccc793888c672e1d4ccedb5cf847d267887caf1acc1550133fc1c0c271f4e226bf5941fa4e
- TLSH T14241CC7133B6F1D889123F421C686AC413BF4329BA94DE0CB599725EDA2641B5F322F3
- MD5 SHA1 SHA512 TLSH