Analysis
- user interaction
yes - max time kernel
270s - max time network
202s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 14:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mrblock2d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target mrblock2d.exe
- Size 139.2MB
- Sample260523-rr2vasay4n
- SHA256 31cbb0a419dff77c13cc96c47cd6fd0ff549b351bfea2d38d9cbcb31c49194a4
- MD5 f18084fccf0a1ce28ca247d68404b556
- SHA1 e6e0c141fc4f8857f19f6a796cd8218e492a4183
- SHA512 1a21a8e73c8094debc8ad6a4f66914ba0266379eae33cbd845a106f59aacf702dc6637e6c55ac9ee70a306d001a7e093e7d4fa453f0083ad32d2456c056c5513
- SSDEEP 786432:Udlyi2IcIwdyaRsw8UD87dGVCWth/1k5zDNzZhxfGdwmNsP:UdliIZoDi5Wth/1k5tzZKwmNsP
- TLSH T1ED689D0177BAA463D167917946AFA002FB31B0032774DAC7376C83646F53EE46EBAB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion reg.exe - Loads dropped DLL 5 IoCs
pid Process 5028 mrblock2d.exe 5028 mrblock2d.exe 5028 mrblock2d.exe 5028 mrblock2d.exe 5028 mrblock2d.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mrblock2d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString mrblock2d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 mrblock2d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz mrblock2d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz mrblock2d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz mrblock2d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString mrblock2d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz mrblock2d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mrblock2d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mrblock2d.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\PreferredProfile reg.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities reg.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5028 mrblock2d.exe 5028 mrblock2d.exe 5028 mrblock2d.exe 5028 mrblock2d.exe 5028 mrblock2d.exe 5028 mrblock2d.exe 5028 mrblock2d.exe 5028 mrblock2d.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5028 mrblock2d.exe Token: 33 1628 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1628 AUDIODG.EXE Token: SeDebugPrivilege 5028 mrblock2d.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5028 wrote to memory of 1028 5028 mrblock2d.exe 80 PID 1028 wrote to memory of 1476 1028 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\mrblock2d.exe"C:\Users\Admin\AppData\Local\Temp\mrblock2d.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\DESCRIPTION\System""2⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\system32\reg.exereg query "HKLM\HARDWARE\DESCRIPTION\System"3⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:1476
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004801⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5020
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
- Size 134KB
- SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
- MD5 5dc8861862329b3b4122314922be3ed9
- SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
- SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
- SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
- TLSH T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
- Size 579KB
- SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
- MD5 153a5d422243f7f95721f6c2c5de8c9d
- SHA1 b0f73501859500acd1eccbff3d790abb610511ef
- SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
- SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
- TLSH T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.cache\pkg\a495a53a102ab14fffa66ef28ee85feba4a7bd3288772e6cb88ab04e360da91f\elevate.node
- Size 536KB
- SHA256 a495a53a102ab14fffa66ef28ee85feba4a7bd3288772e6cb88ab04e360da91f
- MD5 48b84c193ecc65e849d188cbba27c1b6
- SHA1 c8e62b5e4551b2c5a63971ee2933e491783bc3df
- SHA512 5d78c39a3e5c35ca61f9c49d708f28516bf583267ffa5639b364abc1b47d2f9a24023fb73469f2c10a00e45ff5479a67cbf2221cd697a68018474f2756162221
- SSDEEP 6144:+h5yPr6FVH0navJSGbTHzQTluxCovUceGSYi3GlXR/dcTlCkb1pUOJN0J0Ww/vUn:+LuruvJzvzxCPXY1C1vWlGSO
- TLSH T1AAC44B167956D679D04AC034C70A8AA33B36B4CE0F2279FF4194663D3E69AF62F38354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
- Size 4KB
- SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
- MD5 4ef9928ec21c398681ed3357aa400c48
- SHA1 5bafcdf7c4ff860ce7f94c5260159e7bf063243b
- SHA512 c0f5f26b249cf3ca72b2d334008a7ab8b7332f286e57edf7c700b5c4a80960dbce14e3db940829134a3bc593a087f56b41afb757daf3f03e32611ab1172c1f6d
- SSDEEP 96:uxGPOUwuHtoSlcl5OVcaljadXHtYXvJsVBOxqSpBS:unuHt/lcl5ramTOxqSm
- TLSH T1CD91639B3E572EA12029D17358192816D307E96B776AF5E8340ED1D81F1A01793FF2B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
- Size 13KB
- SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
- MD5 4c8fce7c4f0bee30b8f03d94fba5b66c
- SHA1 4eb6b34a1547e2da9b1a0daa9c9f7a32569a03e5
- SHA512 0f077d7c2a9801eab3134d4c56793f64fc1c8434e8eabe9c749d0f7d0d875b1750ad0f32873b49778bbb7b5864c280c4546fd72775ad0ec49eb091ec26ee3848
- SSDEEP 192:uuuHt/QidAyuyEWSIvZ+ReCm+arz6hqrREiAdOGL8K8GJhNn6BsxGRm:uuqH+yuChPzAqrREiAdr8K8ab5xb
- TLSH T1F05252132FE927632465D1068A7C966BC368E22B3256B2D0725F97783B0216363FD37D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
- Size 588KB
- SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
- MD5 d1f6e50334a50a3f1f8e35e02d788ad9
- SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
- SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
- SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
- TLSH T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
- Size 550KB
- SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
- MD5 ee6e80bab410c751c935e6175acf8b5c
- SHA1 c44cad6425db5c9c86351f9f9f7b019b876db528
- SHA512 c654c44cfe115a9c4f9eaf6ed4207511c17dc4eeb00441c2be6413d0a16c348fce0dcf282f2b9132948150e3541d248edd62b2e055a1cd902f80b9a67d2e1d77
- SSDEEP 12288:UccjJwUgiy5HMwBAHvrc7XOCzfYt5leQZ:9cjJwUgpHMwBAHvrc7XOcfYDleQZ
- TLSH T15EC46B6677A813A6C17BD13DCA974B29E97138115732A7CF01E452AF0F13BE4693BB20
- MD5 SHA1 SHA512 SSDEEP TLSH