File name:	2025-06-21_b77ef108d5f681f897443af037c13b3c_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/eff9c7ad-c7cf-46dc-b0bd-652db73f3798
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 18:32:43
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	B77EF108D5F681F897443AF037C13B3C
SHA1:	7350399441541A2C76360A216DDE3772CF094404
SHA256:	2BAC962A9FD272CF86BD81C9A53609D32B2CC180F9F305983D2CECC540B9D462
SSDEEP:	24576:msYXjV7ICah6N3OaFJjtkTqyVpiRyzSCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:msYXjVECawN3OaFJjaTqyVpiRyzSoq55

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1999:10:03 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
2760	78F8.tmp	C:\Users\admin\AppData\Local\Temp\7975.tmp		executable
		MD5:AF59EB0FAE16AD5F5D93BF1B3F577DFB	SHA256:17E0E0F0AAB3625A2516BFAF7BDDCD2F77CBF8408983655E7DE9EB237BE7CDC6
3716	2025-06-21_b77ef108d5f681f897443af037c13b3c_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\69A7.tmp		executable
		MD5:301AFE8D719244297443D4EB0381DC52	SHA256:5E4460683FDD6E27B1C091C3E21A748D14963C7BF4B87B4D56DA36CCAC6BCCD5
592	7639.tmp	C:\Users\admin\AppData\Local\Temp\7697.tmp		executable
		MD5:650866DEEAB1DD69A107951E641A038E	SHA256:F2C0847B7D122CB607C81BFAF74C559CE4C14E1BDAAF6C82559F732AA3DD16A0
6620	7791.tmp	C:\Users\admin\AppData\Local\Temp\77EF.tmp		executable
		MD5:EF9CE278097E4D1E3BA4C1852E41012D	SHA256:78D511E0465DCC2F0928EBFDDC9523092E663064AF1EE3DB5682F2C0B937C7BF
7140	6B1E.tmp	C:\Users\admin\AppData\Local\Temp\7639.tmp		executable
		MD5:5007119DCC8AC3E6545751774C068BBE	SHA256:D64F3FCC6BAF5A3DCD423322EA94B0250216FE988F3F1FD2B314482DCEF059E8
5928	7697.tmp	C:\Users\admin\AppData\Local\Temp\7733.tmp		executable
		MD5:11B8D949C3EB6BFB111E8626F931A5B3	SHA256:85EEB375A18DF3BC7F0CFF214E5DF76C8FCB28C2F665335C2168013D1FE12F17
6700	789B.tmp	C:\Users\admin\AppData\Local\Temp\78F8.tmp		executable
		MD5:70A54BB370DB1CD4DC127F19BAA53D32	SHA256:459FAE8EB0B0D2696C2A953A5C5CA6C5EF4DB1256A1622277148D756F7FDB0EC
6900	7733.tmp	C:\Users\admin\AppData\Local\Temp\7791.tmp		executable
		MD5:F76BB8012DD027D155161ADB72A93D28	SHA256:545562CBD62BD6C563C274BF950F206D22889CFB89AE81DFBF4F34CAFE156765
7000	77EF.tmp	C:\Users\admin\AppData\Local\Temp\784D.tmp		executable
		MD5:04137972469BCEFD405388C3A6523FA8	SHA256:554F9520742D3F2B11FF15F4CB9A14BCBCBDF68853038D6B49DEA8346E7E8E7D
1132	7A7F.tmp	C:\Users\admin\AppData\Local\Temp\7AEC.tmp		executable
		MD5:123C6EEBA4257962A52998E4711C5513	SHA256:5A29CA6F8D9E9D175BE931346D7E1466D0F7F73049B89ECDA7F10AF05BBE87AC

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.53.40.176:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.53.40.176:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5116	RUXIMICS.exe	GET	200	23.53.40.176:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.160.2:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5116	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.160.4:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	16.7 Kb	whitelisted
—	—	POST	400	40.126.32.76:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	—	—	whitelisted
—	—	POST	200	20.190.160.64:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5116	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.53.40.176:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.53.40.176:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5116	RUXIMICS.exe	23.53.40.176:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
2336	svchost.exe	172.211.123.250:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted

Domain	IP	Reputation
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.53.40.176 23.53.40.178	whitelisted
www.microsoft.com	23.35.229.160 95.101.149.131	whitelisted
client.wns.windows.com	172.211.123.250	whitelisted
login.live.com	40.126.32.68 40.126.32.133 20.190.160.4 20.190.160.14 40.126.32.138 20.190.160.130 20.190.160.67 20.190.160.22	whitelisted
settings-win.data.microsoft.com	4.231.128.59 40.127.240.158	whitelisted
nexusrules.officeapps.live.com	52.111.236.21	whitelisted
slscr.update.microsoft.com	4.175.87.197	whitelisted
fe3cr.delivery.mp.microsoft.com	20.242.39.171	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224 20.83.72.98	whitelisted

General Info

2025-06-21_b77ef108d5f681f897443af037c13b3c_elex_mafia_stealc_tofsee

B77EF108D5F681F897443AF037C13B3C

7350399441541A2C76360A216DDE3772CF094404

2BAC962A9FD272CF86BD81C9A53609D32B2CC180F9F305983D2CECC540B9D462

24576:msYXjV7ICah6N3OaFJjtkTqyVpiRyzSCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:msYXjVECawN3OaFJjaTqyVpiRyzSoq55

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Executable content was dropped or overwritten

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Starts itself from another location

Starts application with an unusual extension

INFO

Reads the machine GUID from the registry

Checks supported languages

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings