File name:	2025-07-25_ca9e5ef88c11d043a64f10b581416be2_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/aff8f4b0-c53e-4deb-9165-b1d756190651
Verdict:	Malicious activity
Analysis date:	July 25, 2025, 09:00:38
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	CA9E5EF88C11D043A64F10B581416BE2
SHA1:	81DE758B019E1F44D9B75FD59593CBA4A09E9823
SHA256:	314F81D9D61B7DA3DD3FC92F7CE627BB8A3F41153D51FAEACAD6081AE11BE9D1
SSDEEP:	24576:cbY7DncCBuVwZ6xwLEZI3x/CFXkyE2yz:cbY7DncCBuVwZ6xwLEZI3x/CFXkyE2yz

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3936	DB86.tmp	C:\Users\admin\AppData\Local\Temp\DBE4.tmp		executable
		MD5:8ACFCA9E6B97741D54C2AEDFEED5FB2F	SHA256:757895EF2BCA048043112BCA35C11B1EE8D4F5D462A4C51EB21A1FCBCE27CA3B
2880	DA3E.tmp	C:\Users\admin\AppData\Local\Temp\DAAB.tmp		executable
		MD5:B9DC262E27CDBD5D18F369F8AD59FB12	SHA256:487E1D349DF0D3B69D2E60F2D6F6CD6AB1356A8C853AD74D75FD3C60FCFF410E
304	DAAB.tmp	C:\Users\admin\AppData\Local\Temp\DB19.tmp		executable
		MD5:462353DD5DEE959CAF1FCBC3ECDE7D7B	SHA256:DD8B1AC5DCB0CEFD36C4E019C94BB89C98F8C49A2D2B5727043DAFE87E63074C
2168	DC61.tmp	C:\Users\admin\AppData\Local\Temp\DCBF.tmp		executable
		MD5:E6DB63E6E3E8CF03A6D4ABF17A04150E	SHA256:7A25193619F3C3B7CCF40D2743171B7997A23AF32FABE3C5BC6EA84A9321FE8A
6504	DE55.tmp	C:\Users\admin\AppData\Local\Temp\DEB3.tmp		executable
		MD5:E8531E3B9847380B4C2EFBD581D75F12	SHA256:31F00ABB7CCDECFDADA56D92BA4717041317644E9139E4538B592322E2F4D3B7
1040	DCBF.tmp	C:\Users\admin\AppData\Local\Temp\DD2C.tmp		executable
		MD5:4ACF62FE4D466193BFD6C30C0BE38E77	SHA256:A690CD9ED8ABA8C800F9645411192B80A504A72D4C7D0D5DE8D9A47F03BB4EEE
1948	DBE4.tmp	C:\Users\admin\AppData\Local\Temp\DC61.tmp		executable
		MD5:63D0BFC338E819EABA129EAD8AAEB9C3	SHA256:82BAA4FAA2AEF9E550396751D63F9E2AFD1CBD9A62418E57C476FC219F1B61A2
6808	DD2C.tmp	C:\Users\admin\AppData\Local\Temp\DD8A.tmp		executable
		MD5:B4A62E33F02854FCB95916BB4590DAF8	SHA256:45849E37BD27C8BB2D194ECC7605D41E61617E294EC7F03BB76A35545D6A9533
4880	DDF7.tmp	C:\Users\admin\AppData\Local\Temp\DE55.tmp		executable
		MD5:72EC806BB21D0EAE48F6903E92DAF0EF	SHA256:7F69BCD9FD450088AE3FCCCAF41D901999ED9F3AB17CE5AC26EE46BE40762CB1
2028	DD8A.tmp	C:\Users\admin\AppData\Local\Temp\DDF7.tmp		executable
		MD5:88A985BA56D592349771B3D7935D6568	SHA256:5A90BB7FA2BC600051D2C23127BCBDB3CC70511B17A4D18BB2C7060C8705BA3D

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.30:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
828	RUXIMICS.exe	GET	200	23.216.77.30:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
828	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.216.77.30:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.159.128:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	400	40.126.32.136:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	POST	200	20.190.160.64:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	16.7 Kb	whitelisted
—	—	GET	304	172.202.163.200:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	unknown

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
828	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.30:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
828	RUXIMICS.exe	23.216.77.30:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.216.77.30:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
828	RUXIMICS.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208 51.124.78.146	whitelisted
google.com	142.250.185.110	whitelisted
crl.microsoft.com	23.216.77.30 23.216.77.42 23.216.77.28 23.216.77.22 23.216.77.8 2.16.168.114 2.16.168.124	whitelisted
www.microsoft.com	23.35.229.160 95.101.149.131	whitelisted
login.live.com	40.126.31.67 20.190.159.4 20.190.159.128 20.190.159.130 20.190.159.0 20.190.159.2 40.126.31.71 40.126.31.1	whitelisted
client.wns.windows.com	172.211.123.249 172.211.123.250	whitelisted
slscr.update.microsoft.com	74.178.240.61	whitelisted
fe3cr.delivery.mp.microsoft.com	20.3.187.198	whitelisted
self.events.data.microsoft.com	104.208.16.92	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

General Info

2025-07-25_ca9e5ef88c11d043a64f10b581416be2_elex_mafia.exe

CA9E5EF88C11D043A64F10B581416BE2

81DE758B019E1F44D9B75FD59593CBA4A09E9823

314F81D9D61B7DA3DD3FC92F7CE627BB8A3F41153D51FAEACAD6081AE11BE9D1

24576:cbY7DncCBuVwZ6xwLEZI3x/CFXkyE2yz:cbY7DncCBuVwZ6xwLEZI3x/CFXkyE2yz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts itself from another location

Starts a Microsoft application from unusual location

Starts application with an unusual extension

Process drops legitimate windows executable

Executable content was dropped or overwritten

INFO

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings