Analysis
- max time kernel
42s - max time network
36s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/11/2026, 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
erkb3lih.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
erkb3lih.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
erkb3lih.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
erkb3lih.exe
Resource
win11-20260911-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target erkb3lih.exe
- Size 61KB
- Sample261107-xbebyset6v
- SHA256 3bb2ec1e9f64af6e61df180ca08e8ca0d951311a337b602e98236bb4588f1827
- MD5 2f33b309dd0053752aa286e31848f68e
- SHA1 6627b5617fb2bd6406943947fdbc205e86bb6bab
- SHA512 5b30837ca0376c4e22ded5507d875ee904a6df54fa3cd58f66fcddb9a2bf4ca7885374c23a0a1a5ebcfc34d09c01cdede0d51d715732dbc97ddb09df49e0a589
- SSDEEP 1536:QSNEsI6JHMsv2KwXwhlpooY7KKoLjHflH:dCSJH9v2vXMlpoL7KX/l
- TLSH T19E53F61927FD5422F2BEC7BD68B41122C633B5F65935EF4A4ECD55882BA73005AC0B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions erkb3lih.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions erkb3lih.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools erkb3lih.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools erkb3lih.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion erkb3lih.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\erkb3lih = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erkb3lih.exe" erkb3lih.exe Set value (str) \REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\erkb3lih = "C:\\Users\\Admin\\AppData\\Local\\Temp\\erkb3lih.exe" erkb3lih.exe - Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 9 discord.com 10 discord.com 11 discord.com 12 discord.com 13 discord.com - Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 erkb3lih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 erkb3lih.exe - Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
pid Process 1044 wmic.exe 5268 wmic.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname erkb3lih.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain erkb3lih.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 1748 netsh.exe 6056 netsh.exe - Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S erkb3lih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S erkb3lih.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation erkb3lih.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer erkb3lih.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2972 erkb3lih.exe 5296 erkb3lih.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1044 wmic.exe Token: SeSecurityPrivilege 1044 wmic.exe Token: SeTakeOwnershipPrivilege 1044 wmic.exe Token: SeLoadDriverPrivilege 1044 wmic.exe Token: SeSystemProfilePrivilege 1044 wmic.exe Token: SeSystemtimePrivilege 1044 wmic.exe Token: SeProfSingleProcessPrivilege 1044 wmic.exe Token: SeIncBasePriorityPrivilege 1044 wmic.exe Token: SeCreatePagefilePrivilege 1044 wmic.exe Token: SeBackupPrivilege 1044 wmic.exe Token: SeRestorePrivilege 1044 wmic.exe Token: SeShutdownPrivilege 1044 wmic.exe Token: SeDebugPrivilege 1044 wmic.exe Token: SeSystemEnvironmentPrivilege 1044 wmic.exe Token: SeRemoteShutdownPrivilege 1044 wmic.exe Token: SeUndockPrivilege 1044 wmic.exe Token: SeManageVolumePrivilege 1044 wmic.exe Token: 33 1044 wmic.exe Token: 34 1044 wmic.exe Token: 35 1044 wmic.exe Token: 36 1044 wmic.exe Token: SeIncreaseQuotaPrivilege 1044 wmic.exe Token: SeSecurityPrivilege 1044 wmic.exe Token: SeTakeOwnershipPrivilege 1044 wmic.exe Token: SeLoadDriverPrivilege 1044 wmic.exe Token: SeSystemProfilePrivilege 1044 wmic.exe Token: SeSystemtimePrivilege 1044 wmic.exe Token: SeProfSingleProcessPrivilege 1044 wmic.exe Token: SeIncBasePriorityPrivilege 1044 wmic.exe Token: SeCreatePagefilePrivilege 1044 wmic.exe Token: SeBackupPrivilege 1044 wmic.exe Token: SeRestorePrivilege 1044 wmic.exe Token: SeShutdownPrivilege 1044 wmic.exe Token: SeDebugPrivilege 1044 wmic.exe Token: SeSystemEnvironmentPrivilege 1044 wmic.exe Token: SeRemoteShutdownPrivilege 1044 wmic.exe Token: SeUndockPrivilege 1044 wmic.exe Token: SeManageVolumePrivilege 1044 wmic.exe Token: 33 1044 wmic.exe Token: 34 1044 wmic.exe Token: 35 1044 wmic.exe Token: 36 1044 wmic.exe Token: SeDebugPrivilege 2972 erkb3lih.exe Token: SeIncreaseQuotaPrivilege 5268 wmic.exe Token: SeSecurityPrivilege 5268 wmic.exe Token: SeTakeOwnershipPrivilege 5268 wmic.exe Token: SeLoadDriverPrivilege 5268 wmic.exe Token: SeSystemProfilePrivilege 5268 wmic.exe Token: SeSystemtimePrivilege 5268 wmic.exe Token: SeProfSingleProcessPrivilege 5268 wmic.exe Token: SeIncBasePriorityPrivilege 5268 wmic.exe Token: SeCreatePagefilePrivilege 5268 wmic.exe Token: SeBackupPrivilege 5268 wmic.exe Token: SeRestorePrivilege 5268 wmic.exe Token: SeShutdownPrivilege 5268 wmic.exe Token: SeDebugPrivilege 5268 wmic.exe Token: SeSystemEnvironmentPrivilege 5268 wmic.exe Token: SeRemoteShutdownPrivilege 5268 wmic.exe Token: SeUndockPrivilege 5268 wmic.exe Token: SeManageVolumePrivilege 5268 wmic.exe Token: 33 5268 wmic.exe Token: 34 5268 wmic.exe Token: 35 5268 wmic.exe Token: 36 5268 wmic.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 1044 2972 erkb3lih.exe 80 PID 5296 wrote to memory of 5268 5296 erkb3lih.exe 85 PID 2972 wrote to memory of 1748 2972 erkb3lih.exe 87 PID 5296 wrote to memory of 6056 5296 erkb3lih.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\erkb3lih.exe"C:\Users\Admin\AppData\Local\Temp\erkb3lih.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:1748
-
-
C:\Users\Admin\AppData\Local\Temp\erkb3lih.exeC:\Users\Admin\AppData\Local\Temp\erkb3lih.exe1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5268
-
-
C:\Windows\system32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:6056
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\erkb3lih.exe.log
- Size 1KB
- SHA256 aab6cf1e769a8294b4ae4c538089fa1d4e330157598dc6ab777ee47691edb067
- MD5 08815a0c3a2ca15da8bcaf742ca54182
- SHA1 722093455486516b6a9067395b0a81610a4e7cc6
- SHA512 3d2126a3bfeb2332ef504ebd5a557a001d3e1cfcf7206782fb9272b07459eeede3d41d52d9d6dcda9b9d1917768f9ae298914c78aabab6912e8a6975e3d8d8da
- TLSH T181418B313376A1D449162F470C6D668463FF4329B554EE4CBA98B25EDD2740B5F212F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Darkness-ADMIN.zip
- Size 465KB
- SHA256 e3ad313a1274a9b0c61409e47d40c9e991988ca4d44b08d9bc407ea2f43bead5
- MD5 4f3752ccbfbbe27986acd97dfd92b193
- SHA1 171cbee438c0edfbe5253b13081692bce3dffef3
- SHA512 a07a1cc5276aa786936113e5044560aa2bad17c111fe3561de258895cb1c206f3b4a401240f2ca669ff81cd24f3400934ca9e8f2d0a2759459096ab82f163974
- SSDEEP 12288:MkDwRKLCYsnYsak0Qdijpamxej8mhtxtHf01CwAoOQ/:hwRATeYsakO4Bh5+Rky
- TLSH T1C6A423AEED2FE34D8698C8E4B06B18FCB00257F2675691B19A8DF3105418C7F54E19EE
- MD5 SHA1 SHA512 SSDEEP TLSH