File name:	2025-08-01_a3f69ba68b88c5f3f4bd9815bf743081_elex_mafia_stealc_tofsee.exe
Full analysis:	https://app.any.run/tasks/3ca80904-527f-46f9-a4fd-15d1e2e55bf2
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 02:40:15
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	A3F69BA68B88C5F3F4BD9815BF743081
SHA1:	B22355A99E9D7B61D85C00F6868D2105222429DA
SHA256:	3375F2139057845E8EB1BCF714E1814F5CC42569665C1BFF72D3AC7769BBDC2D
SSDEEP:	24576:wsYXjV7ICcWh4tIDaBYa8ZlH0G+SVPNyz:wsYXjVECcWh4tIDaBYa8ZlH0G+SFNyz

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
4700	DEE1.tmp	C:\Users\admin\AppData\Local\Temp\DF3F.tmp		executable
		MD5:7D0278102314A2FFC77C012500443222	SHA256:6E30DCA06FFB514BF6D7C16FF5B6227370DA1B44B59FF4174E6B53B6155F3C48
512	DF9D.tmp	C:\Users\admin\AppData\Local\Temp\E00A.tmp		executable
		MD5:C29715AA685DB7EEDE2A7048E473C73D	SHA256:B34E20EF6C3BA40D4F8F84D8DABBAD2D5D58C6A761552621BC9F9FAFB0115E9D
3580	2025-08-01_a3f69ba68b88c5f3f4bd9815bf743081_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\DE64.tmp		executable
		MD5:F2757634687ACC1600FD1C87BB725377	SHA256:A17F1FC8EACF5CCC6FE793FB375955DBC887A953F41C4F27B7E13C1FB398F4C3
4648	E00A.tmp	C:\Users\admin\AppData\Local\Temp\E068.tmp		executable
		MD5:D4DB2BE15040DA3A79719AD12A7232ED	SHA256:7C4F6BC17D2FCE412155FA4D030C23C12108A5981A30E22FB795F78FFBCD5687
2148	E143.tmp	C:\Users\admin\AppData\Local\Temp\E1C0.tmp		executable
		MD5:76FA4E2E4CA3BAA9983FA652BBFE4DB2	SHA256:F45E93F6921FC4043F31677E1ECF9DDA81262E7A2FABBD794031EF539E4A838F
6472	E068.tmp	C:\Users\admin\AppData\Local\Temp\E0D5.tmp		executable
		MD5:80303FE734EBDDA2B0929E3627C95AD4	SHA256:9C366F2D4D99FB4DD42F79613F32AF09120D97E7FE08B37F5C79F494A36D2F73
4664	E4FC.tmp	C:\Users\admin\AppData\Local\Temp\E55A.tmp		executable
		MD5:D1775D639F9372AA98BCDCDAD429FE92	SHA256:061E0B74D76A238EFE18673E52BCACBA0EB9AAA3F39AC2A0868F57576860B7BA
1180	E3A4.tmp	C:\Users\admin\AppData\Local\Temp\E402.tmp		executable
		MD5:9310B54CED02BF05B2A41831410C983F	SHA256:5A38A9036E576DF31BBFABC947E5389337463FF8F014941512461EF224F100EE
7124	E22D.tmp	C:\Users\admin\AppData\Local\Temp\E28B.tmp		executable
		MD5:6660B1DA1B1A4544F63C5CB2C782EA5C	SHA256:42F0F742D2DE528F015BC5E72F9F676712C1DC5BC64D26ABCE084FBAA8A793FB
2028	E0D5.tmp	C:\Users\admin\AppData\Local\Temp\E143.tmp		executable
		MD5:EF515C1EC467EDD14351B013CA79C204	SHA256:7A776F30E6CA325A23992254DF548471ED124788F15095E7D7AE6B5AC8341838

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
3876	RUXIMICS.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
3876	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3876	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
3876	RUXIMICS.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 40.127.240.158	whitelisted
google.com	216.58.206.78	whitelisted
crl.microsoft.com	23.216.77.6 23.216.77.28	whitelisted
www.microsoft.com	23.35.229.160	whitelisted
self.events.data.microsoft.com	20.52.64.201	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

General Info

2025-08-01_a3f69ba68b88c5f3f4bd9815bf743081_elex_mafia_stealc_tofsee.exe

A3F69BA68B88C5F3F4BD9815BF743081

B22355A99E9D7B61D85C00F6868D2105222429DA

3375F2139057845E8EB1BCF714E1814F5CC42569665C1BFF72D3AC7769BBDC2D

24576:wsYXjV7ICcWh4tIDaBYa8ZlH0G+SVPNyz:wsYXjVECcWh4tIDaBYa8ZlH0G+SFNyz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Starts itself from another location

Executable content was dropped or overwritten

Starts application with an unusual extension

INFO

Reads the computer name

Checks supported languages

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings