File name:	2025-07-06_1176e3d7be04bb6811e1d75467b5d02f_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/82a02db2-8e1c-4e2f-82d8-3ab4fc0ef940
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 01:44:54
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	1176E3D7BE04BB6811E1D75467B5D02F
SHA1:	7131EF5A50F555968AC0DFCA6BAA90EDCC5E48B4
SHA256:	35DFE01AD31FAD00D7C0EC1FDBAAAAC9622B24D95050E3CB43281C3DFA3DBFE2
SSDEEP:	24576:emsYXjV7ICEtHHMXOTbfG+V+VbtfVoySJyz:lsYXjVECEtHHMXOnfG+V+VbtfKySJyz

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
2368	6188.tmp	C:\Users\admin\AppData\Local\Temp\61E6.tmp		executable
		MD5:74C8F426CD317E512CC0247ACBA86F8E	SHA256:3D250FCCEB0299F30488B4566FAF5A0C13E1232E955A9B55E4D08CE2465B80C4
4400	5F17.tmp	C:\Users\admin\AppData\Local\Temp\5F94.tmp		executable
		MD5:4D46449DB86A22DF58E80FEF4966E567	SHA256:4124BCAEE7DDA58C04B25D67CA629663DECB7558F488E1539CA6817B8FE82B37
1332	5DEF.tmp	C:\Users\admin\AppData\Local\Temp\5E5C.tmp		executable
		MD5:1E2A803AEC814B9E5A56816B2D780F66	SHA256:79FD1B54248F18D771E81FFC5D75F93E3FD1566F65A27B916F71BEA87F342F3D
6720	5D23.tmp	C:\Users\admin\AppData\Local\Temp\5D91.tmp		executable
		MD5:526157275E281ACC2573A523C850FD2E	SHA256:A9E3C95E867227C3E5FF59CBEA0541C06ACB2AC44409BD693AE0A4BE2EF2BF09
2536	607F.tmp	C:\Users\admin\AppData\Local\Temp\60EC.tmp		executable
		MD5:1F3C17EC13E5CF21C1BB5ACB2BF506C9	SHA256:086A060B1A6583A294A5BE61708C413C83B36E4BBC183C0251654007E93FCBAA
2668	5F94.tmp	C:\Users\admin\AppData\Local\Temp\6002.tmp		executable
		MD5:DF4C1423C11690130AC462294EAA65B4	SHA256:D894434D580F05B88C484EA9C28D68025285C935AFF58D1E23A335E227ABA30E
6668	2025-07-06_1176e3d7be04bb6811e1d75467b5d02f_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5C87.tmp		executable
		MD5:C9B19708A0A74591BAB21E80CE846BAA	SHA256:C4F7C7A0C6CC3FAA8B40BD3E235C73020F8A27B0FC6DD8576740246F31096EF7
1056	5EBA.tmp	C:\Users\admin\AppData\Local\Temp\5F17.tmp		executable
		MD5:4728FC935D0DDFFD9B3DFD606D5EE506	SHA256:5E3182677A71EDFDC4470C6A571419003B3695DDDB9109817B6F5A6844300DB8
5960	5E5C.tmp	C:\Users\admin\AppData\Local\Temp\5EBA.tmp		executable
		MD5:29C5525C33F65FAAD815658E8B5AC6FA	SHA256:6B40C5337BDAB24755DBED5A1F016AE4F0BDFF9D6323A3E9EAC2C1F07E374032
4024	5D91.tmp	C:\Users\admin\AppData\Local\Temp\5DEF.tmp		executable
		MD5:BBB7D72CA23FEDF67CA95A520BAEC6BA	SHA256:A7F4747764FF31ABED2E0C7A245B8D56F99EB3DD5C0813E8ECDEF10EA30C3287

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
1268	svchost.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
7152	RUXIMICS.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
—	—	POST	200	40.126.32.76:443	https://login.live.com/RST2.srf	US	xml	1.24 Kb	whitelisted
—	—	POST	400	40.126.31.71:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	40.126.32.76:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	40.126.31.71:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	20.190.159.75:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	—	—	whitelisted
—	—	GET	304	4.245.163.56:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	US	—	—	unknown

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
7152	RUXIMICS.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
7152	RUXIMICS.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
google.com	142.250.186.174	whitelisted
crl.microsoft.com	23.216.77.6 23.216.77.28 2.20.245.139 2.20.245.137	whitelisted
www.microsoft.com	184.30.21.171 95.101.149.131	whitelisted
settings-win.data.microsoft.com	51.124.78.146	whitelisted
login.live.com	20.190.159.23 20.190.159.128 40.126.31.3 20.190.159.131 20.190.159.129 40.126.31.131 40.126.31.0 20.190.159.71	whitelisted
nexusrules.officeapps.live.com	52.111.229.48	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	52.165.164.15	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
x1.c.lencr.org	23.209.209.135	whitelisted

General Info

2025-07-06_1176e3d7be04bb6811e1d75467b5d02f_elex_mafia_stealc_tofsee

1176E3D7BE04BB6811E1D75467B5D02F

7131EF5A50F555968AC0DFCA6BAA90EDCC5E48B4

35DFE01AD31FAD00D7C0EC1FDBAAAAC9622B24D95050E3CB43281C3DFA3DBFE2

24576:emsYXjV7ICEtHHMXOTbfG+V+VbtfVoySJyz:lsYXjVECEtHHMXOnfG+V+VbtfKySJyz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts application with an unusual extension

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts a Microsoft application from unusual location

Starts itself from another location

INFO

Reads the computer name

Checks supported languages

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings