File name:	2025-06-21_1ed4bff62ddd814acfa2c525ad81ff8d_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/82839ba2-7b9a-4123-9598-c0e961810084
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 01:55:04
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 13 sections
MD5:	1ED4BFF62DDD814ACFA2C525AD81FF8D
SHA1:	15084C929F54D7F975078D6588BE40D01A76511F
SHA256:	2ACE73D06A2DB57A667C0E77450A49C2CC7A9E48EE93CE04734443E74D3CAB3B
SSDEEP:	12288:KsYXHjErS5EWEc59eyCXk+/UaPliAH5ejiVxVVh6yzDtYFVg0M1:KsYXjV7TC0+/BoAZejiVuyzpYFV/M1

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2005:03:25 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3640	6D6F.tmp	C:\Users\admin\AppData\Local\Temp\6DEC.tmp		executable
		MD5:C8CDD47F03EF8EF176B23476C1A222D4	SHA256:84468569077F412EBA42F4F94045A08E02142C80B1B6D4E8D59C9D3F2451E461
6460	6EB7.tmp	C:\Users\admin\AppData\Local\Temp\6F34.tmp		executable
		MD5:8869372FE2FDDCDD1B1C469C9E880869	SHA256:413F2B99A6F87C3FD169F6C1C90BCC28C99EE77F47C562BDB009DDB0CF99E88F
6376	6F34.tmp	C:\Users\admin\AppData\Local\Temp\6F92.tmp		executable
		MD5:DBCAA99C620AE1B3011D192533285065	SHA256:8F46F75737394419B2E60837F89406A2595C5AAF978DA3B01A13E3A78E6D6D7E
4232	6DEC.tmp	C:\Users\admin\AppData\Local\Temp\6E5A.tmp		executable
		MD5:6249E11C35F76A92E6D96ABAB4FBC330	SHA256:5DB0EDAD2AD764B97CFB21BDA40F2C1BB7D2AE0926D19FBF17FA732F83A0C7F3
4844	6E5A.tmp	C:\Users\admin\AppData\Local\Temp\6EB7.tmp		executable
		MD5:66FF9FF23E11AAF74F33B7030F24BED0	SHA256:CD48B5CC9643C6B788808933F22CF4971312A79ADBE638CC75510E945CE1398F
5008	6FE0.tmp	C:\Users\admin\AppData\Local\Temp\703E.tmp		executable
		MD5:0955985534E48B21C30D935940C8F0F3	SHA256:38494502199A0150ED1F7DE8F15B9F87C557C26A787D70A2253CF96669542E6D
6868	6F92.tmp	C:\Users\admin\AppData\Local\Temp\6FE0.tmp		executable
		MD5:6DC303EF7FF30C717275A2E6068E58E5	SHA256:29BEB30B16115E97F75F889F2CBD852E86B0EE5A9FF611A5C82390FBDE44BE20
6140	703E.tmp	C:\Users\admin\AppData\Local\Temp\708C.tmp		executable
		MD5:76323DAF2CBB3A7C22297B82BA436BEB	SHA256:1E45EC84151FDED86E61238C0236831F21C74120B371C9854A6AB3F000A53422
6704	2025-06-21_1ed4bff62ddd814acfa2c525ad81ff8d_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\6D6F.tmp		executable
		MD5:5BFD07F2073FED195D4C6EBFA362EBA8	SHA256:AD1B7467ACAA1103293241F3CD15C03FD56F711E19D105AF31415771EA3716C8
5716	7455.tmp	C:\Users\admin\AppData\Local\Temp\74B3.tmp		executable
		MD5:CE537F36BAF727D0FACBCA9AE14EB172	SHA256:848A9CC37FA71791E464FE18C4EAE10FE78B842C1513E2D5A3AFE0BC2321BDE5

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5116	RUXIMICS.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5116	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.159.2:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	200	20.190.159.2:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	16.7 Kb	whitelisted
—	—	POST	200	40.126.31.129:443	https://login.live.com/RST2.srf	unknown	—	—	whitelisted
—	—	POST	200	20.190.159.0:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5116	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5944	MoUsoCoreWorker.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5116	RUXIMICS.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 51.104.136.2	whitelisted
google.com	172.217.16.142	whitelisted
crl.microsoft.com	23.55.104.172 23.55.104.190 23.53.40.176 23.53.40.178	whitelisted
www.microsoft.com	95.101.149.131 23.35.229.160	whitelisted
client.wns.windows.com	172.211.123.249	whitelisted
login.live.com	40.126.32.76 40.126.32.133 20.190.160.128 40.126.32.72 40.126.32.138 20.190.160.17 20.190.160.64 20.190.160.22	whitelisted
nexusrules.officeapps.live.com	52.111.236.21	whitelisted
slscr.update.microsoft.com	4.175.87.197	whitelisted
fe3cr.delivery.mp.microsoft.com	20.242.39.171	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

General Info

2025-06-21_1ed4bff62ddd814acfa2c525ad81ff8d_elex_mafia_stealc_tofsee

1ED4BFF62DDD814ACFA2C525AD81FF8D

15084C929F54D7F975078D6588BE40D01A76511F

2ACE73D06A2DB57A667C0E77450A49C2CC7A9E48EE93CE04734443E74D3CAB3B

12288:KsYXHjErS5EWEc59eyCXk+/UaPliAH5ejiVxVVh6yzDtYFVg0M1:KsYXjV7TC0+/BoAZejiVuyzpYFV/M1

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings