File name:	2025-06-22_77a6c57cc65de33d463641bb00fe4eca_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/ac0903c3-3abb-4bbe-8fec-e03cf10ebed3
Verdict:	Malicious activity
Analysis date:	June 22, 2025, 00:48:15
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	77A6C57CC65DE33D463641BB00FE4ECA
SHA1:	66E2C50EC8378419D48082243CB6A2C32CA86A94
SHA256:	0BB9AF2FCACBD92AD560730D7CCFCA85341F318896CD9DEF65445FFFE05FCA9C
SSDEEP:	24576:emsYXjV7ICDpCpknecVmY899Nd8X17cI0Ystyz:lsYXjVECDpCpknecVmY8ld8X17cI0YcU

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
6852	2025-06-22_77a6c57cc65de33d463641bb00fe4eca_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\69A7.tmp		executable
		MD5:A530C0C301519DFAABAEABE6A6549EB5	SHA256:456B76EE232E42AFD8B5E221A916C19536EE85C0FFDF5E7783F053D3CD59EAB4
2044	69A7.tmp	C:\Users\admin\AppData\Local\Temp\6A24.tmp		executable
		MD5:B7C793DD61EB0C80FED708890EA2CA6F	SHA256:69E0DDE4B66D20688DB3950D25A4838948B2AF9515DE4F8175B8FF67E4F2BA9C
4160	6A81.tmp	C:\Users\admin\AppData\Local\Temp\6ADF.tmp		executable
		MD5:F55DA04FE82EE0CBDCC2EA105156D030	SHA256:5A04F6163AF07147D7A4AB8330A960717F2CE94F8394520C01043C49E913F458
3028	6A24.tmp	C:\Users\admin\AppData\Local\Temp\6A81.tmp		executable
		MD5:312EE1805F4192BC837FA60080FE72AA	SHA256:ECA517D06B2CDA63FC2EE07B3C3351EF2EFC77FAB5483CF4DFC6326F39104F2A
2780	6ADF.tmp	C:\Users\admin\AppData\Local\Temp\6B5C.tmp		executable
		MD5:7AB4A0EDDECD36A6202CB94C3710A1D7	SHA256:A08E240DF5AA0ECDEE8C34A6EE75AEB97D0D892AF6AF2536F9888C8F3B47A81D
4816	6E0C.tmp	C:\Users\admin\AppData\Local\Temp\6E69.tmp		executable
		MD5:A5F976ED2F112A497C848872FB680D08	SHA256:300D11B7C00EB4E95EF5F640E7DDBD086206E0F5ECFF8AF276DBEFDD7826B8D3
7060	6C46.tmp	C:\Users\admin\AppData\Local\Temp\6CA4.tmp		executable
		MD5:A9EEF01C3DEB19E02647DA7CEFA99427	SHA256:92B4D8C3874B40D31B6FB72B1E19E6ACE4A877D3D33E21018BD51F78B38CE605
640	6D50.tmp	C:\Users\admin\AppData\Local\Temp\6D9E.tmp		executable
		MD5:BA8DA366C2A4828B0E91FC1E6C55C7B9	SHA256:3E87AF3BAA29B91E4C6DA3BD117E870390E388E8C51D9E6B163B8BE56F953E63
2216	6D9E.tmp	C:\Users\admin\AppData\Local\Temp\6E0C.tmp		executable
		MD5:C5B3FD5DFCF885CF4FC12A7D12B4DBE8	SHA256:9CF22DB178B9E149E0037149AB98555A21F209F20E226EBEF94BA28F6EA6D8C0
4764	6F44.tmp	C:\Users\admin\AppData\Local\Temp\6FB1.tmp		executable
		MD5:4105AD06712D2B9C2AEDE9A0B176690A	SHA256:2D03BC46979E727F6B502CE6DF55765ECA0E4983C92A1C6261B0A15D0B9EEA8D

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	184.25.50.10:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	184.25.50.10:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4680	RUXIMICS.exe	GET	200	184.25.50.10:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
4680	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	40.126.31.0:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	200	20.190.159.131:443	https://login.live.com/RST2.srf	unknown	—	—	whitelisted
—	—	POST	200	40.126.31.0:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	16.7 Kb	whitelisted
—	—	POST	200	20.190.159.129:443	https://login.live.com/RST2.srf	unknown	xml	10.3 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4680	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	184.25.50.10:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.25.50.10:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
4680	RUXIMICS.exe	184.25.50.10:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 20.73.194.208	whitelisted
google.com	216.58.212.142	whitelisted
crl.microsoft.com	184.25.50.10 184.25.50.8 23.53.40.178 23.53.40.176	whitelisted
www.microsoft.com	95.101.149.131 184.30.21.171	whitelisted
client.wns.windows.com	172.211.123.248	whitelisted
login.live.com	40.126.31.73 40.126.31.2 20.190.159.23 40.126.31.71 40.126.31.131 40.126.31.128 40.126.31.1 20.190.159.75	whitelisted
nexusrules.officeapps.live.com	52.111.227.14	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	20.3.187.198	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted

General Info

2025-06-22_77a6c57cc65de33d463641bb00fe4eca_elex_mafia_stealc_tofsee

77A6C57CC65DE33D463641BB00FE4ECA

66E2C50EC8378419D48082243CB6A2C32CA86A94

0BB9AF2FCACBD92AD560730D7CCFCA85341F318896CD9DEF65445FFFE05FCA9C

24576:emsYXjV7ICDpCpknecVmY899Nd8X17cI0Ystyz:lsYXjVECDpCpknecVmY8ld8X17cI0YcU

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Reads the machine GUID from the registry

Checks supported languages

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings