Analysis
- user interaction
yes - max time kernel
44s - max time network
36s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
07/11/2026, 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
erkb3lih.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
erkb3lih.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
erkb3lih.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
erkb3lih.exe
Resource
win11-20260911-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target erkb3lih.exe
- Size 61KB
- Sample261107-xbebyset6v
- SHA256 3bb2ec1e9f64af6e61df180ca08e8ca0d951311a337b602e98236bb4588f1827
- MD5 2f33b309dd0053752aa286e31848f68e
- SHA1 6627b5617fb2bd6406943947fdbc205e86bb6bab
- SHA512 5b30837ca0376c4e22ded5507d875ee904a6df54fa3cd58f66fcddb9a2bf4ca7885374c23a0a1a5ebcfc34d09c01cdede0d51d715732dbc97ddb09df49e0a589
- SSDEEP 1536:QSNEsI6JHMsv2KwXwhlpooY7KKoLjHflH:dCSJH9v2vXMlpoL7KX/l
- TLSH T19E53F61927FD5422F2BEC7BD68B41122C633B5F65935EF4A4ECD55882BA73005AC0B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions erkb3lih.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions erkb3lih.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools erkb3lih.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools erkb3lih.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion erkb3lih.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erkb3lih = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erkb3lih.exe" erkb3lih.exe Set value (str) \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erkb3lih = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erkb3lih.exe" erkb3lih.exe - Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 18 discord.com 19 discord.com 20 discord.com 21 discord.com 22 discord.com - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 erkb3lih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 erkb3lih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum erkb3lih.exe - Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 3860 wmic.exe 4472 wmic.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain erkb3lih.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2844 netsh.exe 1920 netsh.exe - Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S erkb3lih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S erkb3lih.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer erkb3lih.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3860 wmic.exe 3860 wmic.exe 3860 wmic.exe 3860 wmic.exe 2132 erkb3lih.exe 4472 wmic.exe 4472 wmic.exe 4472 wmic.exe 4472 wmic.exe 2664 erkb3lih.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3860 wmic.exe Token: SeSecurityPrivilege 3860 wmic.exe Token: SeTakeOwnershipPrivilege 3860 wmic.exe Token: SeLoadDriverPrivilege 3860 wmic.exe Token: SeSystemProfilePrivilege 3860 wmic.exe Token: SeSystemtimePrivilege 3860 wmic.exe Token: SeProfSingleProcessPrivilege 3860 wmic.exe Token: SeIncBasePriorityPrivilege 3860 wmic.exe Token: SeCreatePagefilePrivilege 3860 wmic.exe Token: SeBackupPrivilege 3860 wmic.exe Token: SeRestorePrivilege 3860 wmic.exe Token: SeShutdownPrivilege 3860 wmic.exe Token: SeDebugPrivilege 3860 wmic.exe Token: SeSystemEnvironmentPrivilege 3860 wmic.exe Token: SeRemoteShutdownPrivilege 3860 wmic.exe Token: SeUndockPrivilege 3860 wmic.exe Token: SeManageVolumePrivilege 3860 wmic.exe Token: 33 3860 wmic.exe Token: 34 3860 wmic.exe Token: 35 3860 wmic.exe Token: 36 3860 wmic.exe Token: SeIncreaseQuotaPrivilege 3860 wmic.exe Token: SeSecurityPrivilege 3860 wmic.exe Token: SeTakeOwnershipPrivilege 3860 wmic.exe Token: SeLoadDriverPrivilege 3860 wmic.exe Token: SeSystemProfilePrivilege 3860 wmic.exe Token: SeSystemtimePrivilege 3860 wmic.exe Token: SeProfSingleProcessPrivilege 3860 wmic.exe Token: SeIncBasePriorityPrivilege 3860 wmic.exe Token: SeCreatePagefilePrivilege 3860 wmic.exe Token: SeBackupPrivilege 3860 wmic.exe Token: SeRestorePrivilege 3860 wmic.exe Token: SeShutdownPrivilege 3860 wmic.exe Token: SeDebugPrivilege 3860 wmic.exe Token: SeSystemEnvironmentPrivilege 3860 wmic.exe Token: SeRemoteShutdownPrivilege 3860 wmic.exe Token: SeUndockPrivilege 3860 wmic.exe Token: SeManageVolumePrivilege 3860 wmic.exe Token: 33 3860 wmic.exe Token: 34 3860 wmic.exe Token: 35 3860 wmic.exe Token: 36 3860 wmic.exe Token: SeDebugPrivilege 2132 erkb3lih.exe Token: SeIncreaseQuotaPrivilege 4472 wmic.exe Token: SeSecurityPrivilege 4472 wmic.exe Token: SeTakeOwnershipPrivilege 4472 wmic.exe Token: SeLoadDriverPrivilege 4472 wmic.exe Token: SeSystemProfilePrivilege 4472 wmic.exe Token: SeSystemtimePrivilege 4472 wmic.exe Token: SeProfSingleProcessPrivilege 4472 wmic.exe Token: SeIncBasePriorityPrivilege 4472 wmic.exe Token: SeCreatePagefilePrivilege 4472 wmic.exe Token: SeBackupPrivilege 4472 wmic.exe Token: SeRestorePrivilege 4472 wmic.exe Token: SeShutdownPrivilege 4472 wmic.exe Token: SeDebugPrivilege 4472 wmic.exe Token: SeSystemEnvironmentPrivilege 4472 wmic.exe Token: SeRemoteShutdownPrivilege 4472 wmic.exe Token: SeUndockPrivilege 4472 wmic.exe Token: SeManageVolumePrivilege 4472 wmic.exe Token: 33 4472 wmic.exe Token: 34 4472 wmic.exe Token: 35 4472 wmic.exe Token: 36 4472 wmic.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2132 wrote to memory of 3860 2132 erkb3lih.exe 84 PID 2664 wrote to memory of 4472 2664 erkb3lih.exe 89 PID 2132 wrote to memory of 2844 2132 erkb3lih.exe 92 PID 2664 wrote to memory of 1920 2664 erkb3lih.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\erkb3lih.exe"C:\Users\Admin\AppData\Local\Temp\erkb3lih.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\erkb3lih.exeC:\Users\Admin\AppData\Local\Temp\erkb3lih.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1920
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\erkb3lih.exe.log
- Size 1KB
- SHA256 f232701e54dba2e9d63d31ea75de9ab8302e3b396bfcf7b04b99319db4798fb5
- MD5 04620d8284af32e37e3c9994f1118893
- SHA1 33747a5a7a04bf9f4bee840a3b1e53567805fc45
- SHA512 79a0ce96c5eedaf78cc7c890e8c85e6dc2a79e7e834b88fb537f61044c869fada0f73feae01faf6a4289ead5a1a126698d05dcf2965e2b61522b7a3a3d597416
- TLSH T130419C7132B6A1D449162F970C6865C413FF4369BA94AE0C7AAC621EDD2B4175F312F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Darkness-ADMIN.zip
- Size 469KB
- SHA256 5bc6a09d5c43849eede24e96282fe16f4e469f6b7ee23c63c696b589b1eeae18
- MD5 2cdfeae69f4dbc04abc04fb4bc996100
- SHA1 8461cdac3686b86a123aa5d596e3d5eae85b0af2
- SHA512 435c753707b0f380cfa5b61df3a17fc9c24d838f9dbea1ae293c147d8c7b6ff435b5cd3d722e97dc716cbdbf296df5859db817dfe5c2c2b474611c79d99a7da3
- SSDEEP 12288:slL3Ndh4L/VJtRugiDeJ07ogXT7CitARsQnDSXwL2J83w1lLwaICC:sZNdh2/DfugiD200gj7EDE025tVIJ
- TLSH T181A423C79BE50482CDFF4415164EF8733A7062764F11B9729D271D8ABF822D261C2AAF
- MD5 SHA1 SHA512 SSDEEP TLSH