File name:	2025-07-06_1176e3d7be04bb6811e1d75467b5d02f_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/82a02db2-8e1c-4e2f-82d8-3ab4fc0ef940
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 01:44:54
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	1176E3D7BE04BB6811E1D75467B5D02F
SHA1:	7131EF5A50F555968AC0DFCA6BAA90EDCC5E48B4
SHA256:	35DFE01AD31FAD00D7C0EC1FDBAAAAC9622B24D95050E3CB43281C3DFA3DBFE2
SSDEEP:	24576:emsYXjV7ICEtHHMXOTbfG+V+VbtfVoySJyz:lsYXjVECEtHHMXOnfG+V+VbtfKySJyz

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
6720	5D23.tmp	C:\Users\admin\AppData\Local\Temp\5D91.tmp		executable
		MD5:526157275E281ACC2573A523C850FD2E	SHA256:A9E3C95E867227C3E5FF59CBEA0541C06ACB2AC44409BD693AE0A4BE2EF2BF09
6668	2025-07-06_1176e3d7be04bb6811e1d75467b5d02f_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5C87.tmp		executable
		MD5:C9B19708A0A74591BAB21E80CE846BAA	SHA256:C4F7C7A0C6CC3FAA8B40BD3E235C73020F8A27B0FC6DD8576740246F31096EF7
1056	5EBA.tmp	C:\Users\admin\AppData\Local\Temp\5F17.tmp		executable
		MD5:4728FC935D0DDFFD9B3DFD606D5EE506	SHA256:5E3182677A71EDFDC4470C6A571419003B3695DDDB9109817B6F5A6844300DB8
1332	5DEF.tmp	C:\Users\admin\AppData\Local\Temp\5E5C.tmp		executable
		MD5:1E2A803AEC814B9E5A56816B2D780F66	SHA256:79FD1B54248F18D771E81FFC5D75F93E3FD1566F65A27B916F71BEA87F342F3D
2668	5F94.tmp	C:\Users\admin\AppData\Local\Temp\6002.tmp		executable
		MD5:DF4C1423C11690130AC462294EAA65B4	SHA256:D894434D580F05B88C484EA9C28D68025285C935AFF58D1E23A335E227ABA30E
2536	607F.tmp	C:\Users\admin\AppData\Local\Temp\60EC.tmp		executable
		MD5:1F3C17EC13E5CF21C1BB5ACB2BF506C9	SHA256:086A060B1A6583A294A5BE61708C413C83B36E4BBC183C0251654007E93FCBAA
3948	6002.tmp	C:\Users\admin\AppData\Local\Temp\607F.tmp		executable
		MD5:547AAB39464EA08B023E36E327F3379A	SHA256:4DDE27EC516EB559ADA8F8D31C0E5B69445CA1B9DAB7A4C878A67B09E9B86974
4236	63BB.tmp	C:\Users\admin\AppData\Local\Temp\6409.tmp		executable
		MD5:87F92D83731E695228DA9B5C4E95AA65	SHA256:4C2B4FADAA3CB588B6211C6DFD0F2721D843F114243E0A470B29CEF2F33A3F52
4788	5C87.tmp	C:\Users\admin\AppData\Local\Temp\5D23.tmp		executable
		MD5:E4FAEF9CAAFA1E4F67EE6B1D66E47E6B	SHA256:ADCC0C8F13A38198AF0AA492E1DC82E7365F41493749F0FF16F580279D500098
4024	5D91.tmp	C:\Users\admin\AppData\Local\Temp\5DEF.tmp		executable
		MD5:BBB7D72CA23FEDF67CA95A520BAEC6BA	SHA256:A7F4747764FF31ABED2E0C7A245B8D56F99EB3DD5C0813E8ECDEF10EA30C3287

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
7152	RUXIMICS.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
—	—	POST	200	40.126.32.76:443	https://login.live.com/RST2.srf	US	xml	1.24 Kb	whitelisted
—	—	POST	400	40.126.32.76:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	40.126.31.71:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	40.126.31.71:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	GET	304	4.245.163.56:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	US	—	—	unknown
1268	svchost.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
1268	svchost.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
7152	RUXIMICS.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
7152	RUXIMICS.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
google.com	142.250.186.174	whitelisted
crl.microsoft.com	23.216.77.6 23.216.77.28 2.20.245.139 2.20.245.137	whitelisted
www.microsoft.com	184.30.21.171 95.101.149.131	whitelisted
settings-win.data.microsoft.com	51.124.78.146	whitelisted
login.live.com	20.190.159.23 20.190.159.128 40.126.31.3 20.190.159.131 20.190.159.129 40.126.31.131 40.126.31.0 20.190.159.71	whitelisted
nexusrules.officeapps.live.com	52.111.229.48	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	52.165.164.15	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
x1.c.lencr.org	23.209.209.135	whitelisted

General Info

2025-07-06_1176e3d7be04bb6811e1d75467b5d02f_elex_mafia_stealc_tofsee

1176E3D7BE04BB6811E1D75467B5D02F

7131EF5A50F555968AC0DFCA6BAA90EDCC5E48B4

35DFE01AD31FAD00D7C0EC1FDBAAAAC9622B24D95050E3CB43281C3DFA3DBFE2

24576:emsYXjV7ICEtHHMXOTbfG+V+VbtfVoySJyz:lsYXjVECEtHHMXOnfG+V+VbtfKySJyz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts application with an unusual extension

Starts itself from another location

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings