File name:	2025-06-22_d77236cb1a974dce4a2e8a4a93c1d3d8_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/4d75fd0d-db40-479e-96f7-d2c061ee77a6
Verdict:	Malicious activity
Analysis date:	June 22, 2025, 01:02:07
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 15 sections
MD5:	D77236CB1A974DCE4A2E8A4A93C1D3D8
SHA1:	37A917E49E6D1ED2015C2E246EA1FED589CC8F05
SHA256:	02B2675A5D245B959A3314250F9A2195CEDBC785806127081DFB1F05924B0C0E
SSDEEP:	24576:5sYXjV7ICusgK5pef7EzuWdLRyWZ261yzUj0j8VYJsY1Yt:5sYXjVECusgK5pef7EzuWdLRyWZ261yq

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
2732	2025-06-22_d77236cb1a974dce4a2e8a4a93c1d3d8_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\68FB.tmp		executable
		MD5:E5941EFE7C32B777A9E5AFBB7B1BFEE3	SHA256:02CA5E4C84EC7440F60475ECED8A80E830DE786104A1C8405125AE1A6E9B4686
6004	6958.tmp	C:\Users\admin\AppData\Local\Temp\69B6.tmp		executable
		MD5:FB686FF49A5F57C75CB51C6EE6D7B40D	SHA256:B1A16FF1D00C45389BE36E0358F28461139178D50996EE3D34DC2BEBC6D8A7EB
4676	68FB.tmp	C:\Users\admin\AppData\Local\Temp\6958.tmp		executable
		MD5:703FB9EC6A3A52EB8B47FAAA5461D785	SHA256:DDBA126307F7D8E975A13F57172BAD124D917774FEB7D692249B3854EF73D60B
6336	6A14.tmp	C:\Users\admin\AppData\Local\Temp\6A81.tmp		executable
		MD5:9663D2513D72AE701F78171C091AF2E6	SHA256:298DE5FC1BB55D15D8D09760185E9F80005E8086CACE749E4459D66129AC7231
6536	69B6.tmp	C:\Users\admin\AppData\Local\Temp\6A14.tmp		executable
		MD5:D0E4FAEDE77C315039263AB10E3467FC	SHA256:CC984DA2E69AC92AD91DBAA82A11E9B718EB570641A78E9C03D92D04AB239D4C
3888	6E0C.tmp	C:\Users\admin\AppData\Local\Temp\6EA8.tmp		executable
		MD5:0EE67AD93A80EA473C182CA30A282A48	SHA256:352D578768076ED73616DBB79E977ABAE2C34D2AA55FC343FD72B76966B64842
3100	6EA8.tmp	C:\Users\admin\AppData\Local\Temp\6F06.tmp		executable
		MD5:D2787AC37B6942672C37E38DE7CD4A4F	SHA256:FB681B704BC3CBAC1CC2566E56CA8A1818E34699F59F8E4D875D4B71AB5C2DE5
5900	6D40.tmp	C:\Users\admin\AppData\Local\Temp\6DAE.tmp		executable
		MD5:4E50D1B97BE68C833327F3A7E7BFE8E7	SHA256:E6F33471D985FEDFC2DD8173A40F346AA755C48D424F562B3A57D8FFF9ABFDF8
6140	6ADF.tmp	C:\Users\admin\AppData\Local\Temp\6B6C.tmp		executable
		MD5:DDDB699F12CA4972B15E9BA68CB6DBFE	SHA256:36A2396FD81B1526E360FEDD47F30B65E0FC89B09EF425EDE272684F800EC56D
4844	6A81.tmp	C:\Users\admin\AppData\Local\Temp\6ADF.tmp		executable
		MD5:DC070BA541E012A2A912CB3834E0812B	SHA256:D7E7BB10967C298B1DB23046607117B8AB444FE81565EEB9FAD1E7F628417EDA

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	184.24.77.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	184.24.77.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
4864	RUXIMICS.exe	GET	200	184.24.77.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
4864	RUXIMICS.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.159.131:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	200	40.126.31.71:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	16.7 Kb	whitelisted
—	—	POST	200	40.126.31.71:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted
—	—	POST	200	40.126.31.67:443	https://login.live.com/RST2.srf	unknown	xml	11.0 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4864	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	184.24.77.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.24.77.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
4864	RUXIMICS.exe	184.24.77.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 51.104.136.2	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	184.24.77.12 184.24.77.37 184.24.77.35 184.24.77.6	whitelisted
www.microsoft.com	184.30.21.171 95.101.149.131	whitelisted
login.live.com	40.126.31.129 20.190.159.73 40.126.31.0 40.126.31.131 40.126.31.71 40.126.31.67 20.190.159.4 20.190.159.71	whitelisted
client.wns.windows.com	172.211.123.250 172.211.123.249	whitelisted
nexusrules.officeapps.live.com	52.111.243.29	whitelisted
slscr.update.microsoft.com	52.149.20.212 172.202.163.200	whitelisted
fe3cr.delivery.mp.microsoft.com	40.69.42.241	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98 40.91.76.224	whitelisted

General Info

2025-06-22_d77236cb1a974dce4a2e8a4a93c1d3d8_elex_mafia_stealc_tofsee

D77236CB1A974DCE4A2E8A4A93C1D3D8

37A917E49E6D1ED2015C2E246EA1FED589CC8F05

02B2675A5D245B959A3314250F9A2195CEDBC785806127081DFB1F05924B0C0E

24576:5sYXjV7ICusgK5pef7EzuWdLRyWZ261yzUj0j8VYJsY1Yt:5sYXjVECusgK5pef7EzuWdLRyWZ261yq

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Starts itself from another location

Executable content was dropped or overwritten

Starts application with an unusual extension

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings