File name:	2025-06-21_53fd6f4fe609d21fd390cad00feaaf91_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/c4c5ec00-6a22-4dcf-99ef-41f3e5849621
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 02:05:51
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	53FD6F4FE609D21FD390CAD00FEAAF91
SHA1:	31F0CD034AE16A79DFD3E8053FA35A258DD1B0E0
SHA256:	3037EA734FE4E8826F8B3E4E2E3500AE711B53BD7A41EB6B9E7CCD36FE828BEE
SSDEEP:	24576:msYXjV7IChQvy8tCx6eHF8gwP/Z+ral7yzSCvq5TJLCvY90D8/LVBlVk736Y79G5:msYXjVEChQvy8tCx6eHF8gwP/Z+rQ7yy

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1999:10:03 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
5616	635D.tmp	C:\Users\admin\AppData\Local\Temp\63DA.tmp		executable
		MD5:0508B7D5D121A6F1ECA00E29CBD05405	SHA256:8B39884D9E5AD9EDA54CABADC80739D4B4B00E865F756BA44BD8CBDE838F462C
5612	6774.tmp	C:\Users\admin\AppData\Local\Temp\67F1.tmp		executable
		MD5:2D0B0900AF76582D5CED6B504430ABF7	SHA256:98CB9DFAC43806AE65BB11F9F86087B9CC30306015D15CCE021865355E8C3DFD
6128	67F1.tmp	C:\Users\admin\AppData\Local\Temp\683F.tmp		executable
		MD5:74330DB66391B29E31E62AEE20E21528	SHA256:23F6E790A64B4E485DAEE2AB62C446BF02A41B483DD018C76277D153AF1C7C2C
1520	6438.tmp	C:\Users\admin\AppData\Local\Temp\6496.tmp		executable
		MD5:58EDAAB4B056C5C11B095FE98DAD57BF	SHA256:301B8BDFE2FA49184AE6BAA45084E46142EB3AF7EF55461CAC644730D9D5B995
5884	2025-06-21_53fd6f4fe609d21fd390cad00feaaf91_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\62FF.tmp		executable
		MD5:B97764055A419B830D5CC4EAECFBF4C2	SHA256:0A7B1792CA8824EC21D85749771553B81C5570435537F279B886E74113EB61CD
6840	6503.tmp	C:\Users\admin\AppData\Local\Temp\6561.tmp		executable
		MD5:9391349DD0DAE035E673A4F641B24D04	SHA256:DDF8F7AA39E5151AE6658E0A31070D0772A891C9177C0076D3F82EECFCD30410
4664	65CE.tmp	C:\Users\admin\AppData\Local\Temp\663C.tmp		executable
		MD5:B564E28FC0FD12DD711808BAD5D20065	SHA256:DE921DDA046F08A88F2B4E1232BBF9CF3D866A37635E03E7255C99155CD291CA
4528	663C.tmp	C:\Users\admin\AppData\Local\Temp\66A9.tmp		executable
		MD5:85CA07AA6C12589F1A57E860A995C59D	SHA256:7ADA05B3B78518E9D2C654E626F82A1B580176B9B15ED974D54D0A68FFD86313
5340	62FF.tmp	C:\Users\admin\AppData\Local\Temp\635D.tmp		executable
		MD5:6E8B8BB1E8DB08E4A891495C66B076AD	SHA256:70A308073AF9141FC3245A71BA2A33EDB075DAF3025583F82789CCC743E8E479
4884	6496.tmp	C:\Users\admin\AppData\Local\Temp\6503.tmp		executable
		MD5:5AA3E50A0F1E308F3BFE44DADE01CC04	SHA256:866D19383813984B3D723E340CA54B33DDB3A94B1C4EBDFDCA975A0D387F951A

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.55.104.190:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.55.104.190:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5372	RUXIMICS.exe	GET	200	23.55.104.190:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5372	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.159.130:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	200	20.190.159.130:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	16.7 Kb	whitelisted
—	—	POST	200	40.126.31.2:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted
—	—	POST	200	40.126.31.130:443	https://login.live.com/RST2.srf	unknown	xml	11.0 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5372	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.55.104.190:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1268	svchost.exe	23.55.104.190:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5372	RUXIMICS.exe	23.55.104.190:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 51.104.136.2	whitelisted
google.com	142.250.186.110	whitelisted
crl.microsoft.com	23.55.104.190 23.55.104.172 23.53.40.176 23.53.40.178	whitelisted
www.microsoft.com	95.101.149.131 23.35.229.160	whitelisted
login.live.com	20.190.159.4 20.190.159.73 20.190.159.130 40.126.31.131 20.190.159.64 20.190.159.129 40.126.31.130 20.190.159.75	whitelisted
client.wns.windows.com	172.211.123.248 172.211.123.249	whitelisted
nexusrules.officeapps.live.com	52.111.227.11	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	20.242.39.171	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted

General Info

2025-06-21_53fd6f4fe609d21fd390cad00feaaf91_elex_mafia_stealc_tofsee

53FD6F4FE609D21FD390CAD00FEAAF91

31F0CD034AE16A79DFD3E8053FA35A258DD1B0E0

3037EA734FE4E8826F8B3E4E2E3500AE711B53BD7A41EB6B9E7CCD36FE828BEE

24576:msYXjV7IChQvy8tCx6eHF8gwP/Z+ral7yzSCvq5TJLCvY90D8/LVBlVk736Y79G5:msYXjVEChQvy8tCx6eHF8gwP/Z+rQ7yy

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts application with an unusual extension

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

INFO

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings