File name:	2025-06-21_53fd6f4fe609d21fd390cad00feaaf91_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/c4c5ec00-6a22-4dcf-99ef-41f3e5849621
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 02:05:51
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	53FD6F4FE609D21FD390CAD00FEAAF91
SHA1:	31F0CD034AE16A79DFD3E8053FA35A258DD1B0E0
SHA256:	3037EA734FE4E8826F8B3E4E2E3500AE711B53BD7A41EB6B9E7CCD36FE828BEE
SSDEEP:	24576:msYXjV7IChQvy8tCx6eHF8gwP/Z+ral7yzSCvq5TJLCvY90D8/LVBlVk736Y79G5:msYXjVEChQvy8tCx6eHF8gwP/Z+rQ7yy

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1999:10:03 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
5884	2025-06-21_53fd6f4fe609d21fd390cad00feaaf91_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\62FF.tmp		executable
		MD5:B97764055A419B830D5CC4EAECFBF4C2	SHA256:0A7B1792CA8824EC21D85749771553B81C5570435537F279B886E74113EB61CD
6356	683F.tmp	C:\Users\admin\AppData\Local\Temp\688D.tmp		executable
		MD5:AFD5A6CDAD8E270C587A591A338CB4E1	SHA256:A3492F5079443A72C7B8BCA2E78E3643C21EF56479D845D0F28F74FA76E6E35F
5340	62FF.tmp	C:\Users\admin\AppData\Local\Temp\635D.tmp		executable
		MD5:6E8B8BB1E8DB08E4A891495C66B076AD	SHA256:70A308073AF9141FC3245A71BA2A33EDB075DAF3025583F82789CCC743E8E479
5612	6774.tmp	C:\Users\admin\AppData\Local\Temp\67F1.tmp		executable
		MD5:2D0B0900AF76582D5CED6B504430ABF7	SHA256:98CB9DFAC43806AE65BB11F9F86087B9CC30306015D15CCE021865355E8C3DFD
5504	66F7.tmp	C:\Users\admin\AppData\Local\Temp\6774.tmp		executable
		MD5:7C77764B13AA843FACC0664036AC4A43	SHA256:C6420E716D3D6D51C9BE57DEE199B6EBE6112D239872F12D782B3FC48A85E7E2
4528	663C.tmp	C:\Users\admin\AppData\Local\Temp\66A9.tmp		executable
		MD5:85CA07AA6C12589F1A57E860A995C59D	SHA256:7ADA05B3B78518E9D2C654E626F82A1B580176B9B15ED974D54D0A68FFD86313
4664	65CE.tmp	C:\Users\admin\AppData\Local\Temp\663C.tmp		executable
		MD5:B564E28FC0FD12DD711808BAD5D20065	SHA256:DE921DDA046F08A88F2B4E1232BBF9CF3D866A37635E03E7255C99155CD291CA
2216	68FB.tmp	C:\Users\admin\AppData\Local\Temp\6958.tmp		executable
		MD5:0CA714E7EB26A6F635B99BDF76ADB503	SHA256:0D39DD46E00F016E341A59BD48AF3DF444898E214725243D4C768E7CD45082CA
6128	67F1.tmp	C:\Users\admin\AppData\Local\Temp\683F.tmp		executable
		MD5:74330DB66391B29E31E62AEE20E21528	SHA256:23F6E790A64B4E485DAEE2AB62C446BF02A41B483DD018C76277D153AF1C7C2C
640	66A9.tmp	C:\Users\admin\AppData\Local\Temp\66F7.tmp		executable
		MD5:463CB34D6A4AAF2CF158EE61C7200A57	SHA256:87BD5EEF1F123760C16A78F2F244895C5A68159341831500459973719B7C95F5

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.55.104.190:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.55.104.190:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5372	RUXIMICS.exe	GET	200	23.55.104.190:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5372	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.159.130:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	200	40.126.31.2:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted
—	—	GET	304	4.175.87.197:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	unknown
—	—	POST	200	20.190.159.128:443	https://login.live.com/RST2.srf	unknown	xml	10.3 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5372	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.55.104.190:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1268	svchost.exe	23.55.104.190:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5372	RUXIMICS.exe	23.55.104.190:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 51.104.136.2	whitelisted
google.com	142.250.186.110	whitelisted
crl.microsoft.com	23.55.104.190 23.55.104.172 23.53.40.176 23.53.40.178	whitelisted
www.microsoft.com	95.101.149.131 23.35.229.160	whitelisted
login.live.com	20.190.159.4 20.190.159.73 20.190.159.130 40.126.31.131 20.190.159.64 20.190.159.129 40.126.31.130 20.190.159.75	whitelisted
client.wns.windows.com	172.211.123.248 172.211.123.249	whitelisted
nexusrules.officeapps.live.com	52.111.227.11	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	20.242.39.171	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted

General Info

2025-06-21_53fd6f4fe609d21fd390cad00feaaf91_elex_mafia_stealc_tofsee

53FD6F4FE609D21FD390CAD00FEAAF91

31F0CD034AE16A79DFD3E8053FA35A258DD1B0E0

3037EA734FE4E8826F8B3E4E2E3500AE711B53BD7A41EB6B9E7CCD36FE828BEE

24576:msYXjV7IChQvy8tCx6eHF8gwP/Z+ral7yzSCvq5TJLCvY90D8/LVBlVk736Y79G5:msYXjVEChQvy8tCx6eHF8gwP/Z+rQ7yy

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts application with an unusual extension

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

INFO

Reads the machine GUID from the registry

Reads the computer name

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings