File name:	2025-06-22_4251bab0d7d2adbcd15fd8b01b46d2c0_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/c0dfbb90-2e1b-4a2b-88f7-37b0571f18ea
Verdict:	Malicious activity
Analysis date:	June 22, 2025, 00:39:58
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 15 sections
MD5:	4251BAB0D7D2ADBCD15FD8B01B46D2C0
SHA1:	A0A805195F8C229ED44234FC782456D25891D8F9
SHA256:	0032FDBC2F1FA1032023AC776B3FB88D0DEB37D5ADB392E6F8F63F12EF9ADCD1
SSDEEP:	24576:5sYXjV7ICyWNOOQrqPJtUrj1klnwyzUj0j8VYJsY1Yt:5sYXjVECyuOOQrqPJtUrj1klwyzUj0jG

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
6980	6810.tmp	C:\Users\admin\AppData\Local\Temp\686E.tmp		executable
		MD5:03CE511F9B7BEE9BF67B911804627D23	SHA256:432391BD4CD6F5F6289C7AC05ECA263D6E64E1813C0878A5C0E9E88FB99C1BEB
6360	6745.tmp	C:\Users\admin\AppData\Local\Temp\67A3.tmp		executable
		MD5:3A4177CAAAAD205EC44CB3629A077E03	SHA256:65810B2C13A77BFF4B883ACA9E3A768CA3CF9244B8CBB707FB74FE7583ED7698
6704	67A3.tmp	C:\Users\admin\AppData\Local\Temp\6810.tmp		executable
		MD5:AC9E67437DC3A80D647A34E7C609CB36	SHA256:6001FA8A7CFE247DD65BB79BBF3C4C19D08E6514AB16C70E05F4B5BBE8CCB936
760	6C75.tmp	C:\Users\admin\AppData\Local\Temp\6CD3.tmp		executable
		MD5:BFC405B94D61674928659FB03A624858	SHA256:9FC8832912571044F00FE1612AF0BCCCF3D79D0AB7E6A068E7C4FC47CC0B8FB9
6404	69A7.tmp	C:\Users\admin\AppData\Local\Temp\6A14.tmp		executable
		MD5:BA89F5209D928737EBD1E0EDF559FE2C	SHA256:0E19B88AA324B223F5E42272378D366B36CC39F04E9FCEA9C91169CD6340CE74
4960	68DB.tmp	C:\Users\admin\AppData\Local\Temp\6949.tmp		executable
		MD5:AAF74FEEF746DF85F6C07055A9FAC580	SHA256:994658D85CC5D94ED037EDB9A9B32FC0B9992E0A97B51C02D305E2A95B1D2C50
1380	6A72.tmp	C:\Users\admin\AppData\Local\Temp\6AC0.tmp		executable
		MD5:19D07EC30288F6194A6CF51787056A28	SHA256:1103957B19022E402DCDF538EE92F6BABAFCFCFD541C7ABA9AA0AC7D0D2B29ED
4984	686E.tmp	C:\Users\admin\AppData\Local\Temp\68DB.tmp		executable
		MD5:0B755EA410D9525A1FA282A8234D55B6	SHA256:36560D117B8EB179A64B248D4A410CE8CF49515C8EF0774BFA5A6512728D1263
2276	6949.tmp	C:\Users\admin\AppData\Local\Temp\69A7.tmp		executable
		MD5:FA72D7B258B42A9C14CE4743599BC05B	SHA256:E632053B41F61A4597DC9FDA39BD54EF8E7A99A3B66D02AA07C69CD523DBA6AB
7020	6B2D.tmp	C:\Users\admin\AppData\Local\Temp\6B9B.tmp		executable
		MD5:8973C7701BCD66F5943A12592427C346	SHA256:C8441BFCD405A87E62CC2407AC6B36FA67B806E4DDD45D998BD3D52C6A0789BA

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.55.104.190:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1068	SIHClient.exe	GET	200	23.53.40.178:80	http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl	unknown	—	—	whitelisted
1068	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
—	—	GET	200	20.3.187.198:443	https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping	unknown	—	—	—
1268	svchost.exe	GET	200	23.55.104.190:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1812	RUXIMICS.exe	GET	200	23.55.104.190:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1812	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	40.126.32.140:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1812	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.55.104.190:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1268	svchost.exe	23.55.104.190:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1812	RUXIMICS.exe	23.55.104.190:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 4.231.128.59	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.55.104.190 23.55.104.172 23.53.40.178 23.53.40.176	whitelisted
www.microsoft.com	95.101.149.131 184.30.21.171	whitelisted
client.wns.windows.com	172.211.123.250 172.211.123.248	whitelisted
login.live.com	40.126.31.130 20.190.159.0 40.126.31.129 20.190.159.64 20.190.159.73 20.190.159.71 40.126.31.73 40.126.31.1	whitelisted
nexusrules.officeapps.live.com	52.111.227.14	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	20.3.187.198	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

General Info

2025-06-22_4251bab0d7d2adbcd15fd8b01b46d2c0_elex_mafia_stealc_tofsee

4251BAB0D7D2ADBCD15FD8B01B46D2C0

A0A805195F8C229ED44234FC782456D25891D8F9

0032FDBC2F1FA1032023AC776B3FB88D0DEB37D5ADB392E6F8F63F12EF9ADCD1

24576:5sYXjV7ICyWNOOQrqPJtUrj1klnwyzUj0j8VYJsY1Yt:5sYXjVECyuOOQrqPJtUrj1klwyzUj0jG

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Executable content was dropped or overwritten

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Starts application with an unusual extension

Starts itself from another location

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings