File name:	2025-07-06_1176e3d7be04bb6811e1d75467b5d02f_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/82a02db2-8e1c-4e2f-82d8-3ab4fc0ef940
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 01:44:54
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	1176E3D7BE04BB6811E1D75467B5D02F
SHA1:	7131EF5A50F555968AC0DFCA6BAA90EDCC5E48B4
SHA256:	35DFE01AD31FAD00D7C0EC1FDBAAAAC9622B24D95050E3CB43281C3DFA3DBFE2
SSDEEP:	24576:emsYXjV7ICEtHHMXOTbfG+V+VbtfVoySJyz:lsYXjVECEtHHMXOnfG+V+VbtfKySJyz

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
4788	5C87.tmp	C:\Users\admin\AppData\Local\Temp\5D23.tmp		executable
		MD5:E4FAEF9CAAFA1E4F67EE6B1D66E47E6B	SHA256:ADCC0C8F13A38198AF0AA492E1DC82E7365F41493749F0FF16F580279D500098
6720	5D23.tmp	C:\Users\admin\AppData\Local\Temp\5D91.tmp		executable
		MD5:526157275E281ACC2573A523C850FD2E	SHA256:A9E3C95E867227C3E5FF59CBEA0541C06ACB2AC44409BD693AE0A4BE2EF2BF09
5960	5E5C.tmp	C:\Users\admin\AppData\Local\Temp\5EBA.tmp		executable
		MD5:29C5525C33F65FAAD815658E8B5AC6FA	SHA256:6B40C5337BDAB24755DBED5A1F016AE4F0BDFF9D6323A3E9EAC2C1F07E374032
6732	613A.tmp	C:\Users\admin\AppData\Local\Temp\6188.tmp		executable
		MD5:D5999ECAF9DCDF8AB6455E38941A154C	SHA256:639F779859003B7CC8C2735FFECA7984D669F328B3C312062FBB2509AB4C087B
1056	5EBA.tmp	C:\Users\admin\AppData\Local\Temp\5F17.tmp		executable
		MD5:4728FC935D0DDFFD9B3DFD606D5EE506	SHA256:5E3182677A71EDFDC4470C6A571419003B3695DDDB9109817B6F5A6844300DB8
6140	60EC.tmp	C:\Users\admin\AppData\Local\Temp\613A.tmp		executable
		MD5:1955A38106CA6F004F853996FD003563	SHA256:4D652920B1C4889605C1CD07D149F994C71EDBEA551D300A71787F0D49832C53
5620	635D.tmp	C:\Users\admin\AppData\Local\Temp\63BB.tmp		executable
		MD5:3806E3BFA75549EF3B1D19BA84569AA6	SHA256:7B80D8E8C27929C136EC85980BD381E8DD353D240D98B2461B1B1F967ADE2F43
2680	61E6.tmp	C:\Users\admin\AppData\Local\Temp\6244.tmp		executable
		MD5:2BC2BF74CA4B68067C7BFA33E2B1DB85	SHA256:18324475EB835663E382C81A148001C73FF5437CEC153BF1B489A629430A7F6C
2160	62B1.tmp	C:\Users\admin\AppData\Local\Temp\62FF.tmp		executable
		MD5:0D1EC19DF44D62149EE57F17BC761A1C	SHA256:CAAF1E3E09C37B1983F66433B32F80577C54E91E88BD8AB3DEBE79E205E6C8EB
2668	5F94.tmp	C:\Users\admin\AppData\Local\Temp\6002.tmp		executable
		MD5:DF4C1423C11690130AC462294EAA65B4	SHA256:D894434D580F05B88C484EA9C28D68025285C935AFF58D1E23A335E227ABA30E

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4264	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl	unknown	—	—	whitelisted
4264	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl	unknown	—	—	whitelisted
4264	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl	unknown	—	—	whitelisted
—	—	POST	400	40.126.32.76:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	POST	400	40.126.31.71:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	POST	400	40.126.31.71:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	GET	200	4.245.163.56:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	unknown
4264	SIHClient.exe	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl	unknown	—	—	whitelisted
4264	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
7152	RUXIMICS.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
7152	RUXIMICS.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
google.com	142.250.186.174	whitelisted
crl.microsoft.com	23.216.77.6 23.216.77.28 2.20.245.139 2.20.245.137	whitelisted
www.microsoft.com	184.30.21.171 95.101.149.131	whitelisted
settings-win.data.microsoft.com	51.124.78.146	whitelisted
login.live.com	20.190.159.23 20.190.159.128 40.126.31.3 20.190.159.131 20.190.159.129 40.126.31.131 40.126.31.0 20.190.159.71	whitelisted
nexusrules.officeapps.live.com	52.111.229.48	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	52.165.164.15	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
x1.c.lencr.org	23.209.209.135	whitelisted

General Info

2025-07-06_1176e3d7be04bb6811e1d75467b5d02f_elex_mafia_stealc_tofsee

1176E3D7BE04BB6811E1D75467B5D02F

7131EF5A50F555968AC0DFCA6BAA90EDCC5E48B4

35DFE01AD31FAD00D7C0EC1FDBAAAAC9622B24D95050E3CB43281C3DFA3DBFE2

24576:emsYXjV7ICEtHHMXOTbfG+V+VbtfVoySJyz:lsYXjVECEtHHMXOnfG+V+VbtfKySJyz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts a Microsoft application from unusual location

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings