File name:	2025-06-22_c0f8eb3dca18f916f6a1001cb82b488e_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/95aa7cf4-b196-4d90-9fb7-4b2d1faea205
Verdict:	Malicious activity
Analysis date:	June 22, 2025, 00:59:21
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 15 sections
MD5:	C0F8EB3DCA18F916F6A1001CB82B488E
SHA1:	E7D34E30AF99038AD5E57244EE797526ABDFCC63
SHA256:	1E481738715519342D40A2CB626ACE679C256500320AD8F99A708BFC47398F6C
SSDEEP:	24576:5sYXjV7IC+/Pd3Wa88F6Ct0MM7eZfgCXp/CKkyzUj0j8VYJsY1Yt:5sYXjVEC+3d3v88F6E0MM7eZfgCXp/CZ

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1044	2025-06-22_c0f8eb3dca18f916f6a1001cb82b488e_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\6B2D.tmp		executable
		MD5:DE34397712380046B9240C55E8FF1D8D	SHA256:161534E06855011E26A5C7FDD7AEBBE8B54050CA9BB58D798ECDB16467D651C5
6704	6C85.tmp	C:\Users\admin\AppData\Local\Temp\6CE3.tmp		executable
		MD5:43FACE1809167AECB2DCBA2BB8430417	SHA256:AA91F0152A38FC67236B5BBE17F5BB16418B1A64BEF1C987938BF9C2B87D7DB1
5432	6D9E.tmp	C:\Users\admin\AppData\Local\Temp\6E3A.tmp		executable
		MD5:B9BD79603A7AEA90D16F9000BD1EFAE2	SHA256:5DD0F891BF0D43D949B2BB3462FE24529F0A341B353F734AEABCEDF187EC1F9D
2696	6C08.tmp	C:\Users\admin\AppData\Local\Temp\6C85.tmp		executable
		MD5:4F3EEB08A302BF25205E71176321ED97	SHA256:3532D76666AE2478E015FFE9E325BC2D64483C48899A4BDEFB8BE8FD15333981
1480	702E.tmp	C:\Users\admin\AppData\Local\Temp\70AB.tmp		executable
		MD5:9AA10634F0047ABD55DCAE66DAA8198F	SHA256:910A408833653B98F3B13E481DCC88D01DC949337ED4D533D551B993B7CE871E
5348	6E3A.tmp	C:\Users\admin\AppData\Local\Temp\6EA8.tmp		executable
		MD5:7F472E599706CBA376E64E470ED88CBA	SHA256:C6A1A4BE3140F3EACAED9AE7B8E9E35C6A7CEFEC8E2662E0A66C2FB4ED77160B
3800	6D40.tmp	C:\Users\admin\AppData\Local\Temp\6D9E.tmp		executable
		MD5:EF72EE72A7D730D5029370799A5745BF	SHA256:121604B31CB58276AFE58A86C4B702DDF8E74DC66BCB14FFBE36F43E0261A673
3964	6F06.tmp	C:\Users\admin\AppData\Local\Temp\6F63.tmp		executable
		MD5:0B4CCC8D23006A85696B00DD6FB2D819	SHA256:26B255591545CC26733CBD7099B5E451349C0C00222CADDD5E208D7A4E002048
1296	6F63.tmp	C:\Users\admin\AppData\Local\Temp\702E.tmp		executable
		MD5:6500F82CAFF751B41F5EECBCD5392E6A	SHA256:F5942677175A053F625D3F6E43E52D150B6EFC8B37F4296612E6B6DB9AA29C63
2276	6EA8.tmp	C:\Users\admin\AppData\Local\Temp\6F06.tmp		executable
		MD5:E271B48A2167283852F2B9BFB368A994	SHA256:BED49985D82B2561F07EC2DC061BD929D1D839C079E2617D6DABD9044A96B793

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	184.24.77.37:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1508	RUXIMICS.exe	GET	200	184.24.77.37:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	184.24.77.37:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1508	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.160.17:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	200	20.190.160.17:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	16.7 Kb	whitelisted
—	—	POST	200	20.190.160.2:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted
—	—	POST	200	20.190.160.65:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1508	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	184.24.77.37:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.24.77.37:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1508	RUXIMICS.exe	184.24.77.37:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 51.104.136.2	whitelisted
google.com	142.250.184.238	whitelisted
crl.microsoft.com	184.24.77.37 184.24.77.35 184.24.77.12 2.18.121.147 2.18.121.139	whitelisted
www.microsoft.com	23.35.229.160 95.101.149.131	whitelisted
client.wns.windows.com	172.211.123.250	whitelisted
login.live.com	40.126.32.136 20.190.160.131 20.190.160.5 20.190.160.66 40.126.32.140 40.126.32.133 20.190.160.14 40.126.32.134	whitelisted
nexusrules.officeapps.live.com	52.111.227.14	whitelisted
slscr.update.microsoft.com	4.245.163.56	whitelisted
fe3cr.delivery.mp.microsoft.com	40.69.42.241	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted

General Info

2025-06-22_c0f8eb3dca18f916f6a1001cb82b488e_elex_mafia_stealc_tofsee

C0F8EB3DCA18F916F6A1001CB82B488E

E7D34E30AF99038AD5E57244EE797526ABDFCC63

1E481738715519342D40A2CB626ACE679C256500320AD8F99A708BFC47398F6C

24576:5sYXjV7IC+/Pd3Wa88F6Ct0MM7eZfgCXp/CKkyzUj0j8VYJsY1Yt:5sYXjVEC+3d3v88F6E0MM7eZfgCXp/CZ

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings