File name:	2025-07-06_d2a270c20823ed225a7bd65d5bf4b85d_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/07ed8353-777f-4013-95ef-9557d7928774
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 03:09:51
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 15 sections
MD5:	D2A270C20823ED225A7BD65D5BF4B85D
SHA1:	CE25FD0C2A081A43802D4255262B98794EEB5123
SHA256:	53978E100FA4D620F3F87B11A32BFF5277F89B3A113F6A612D374CC60D34C6CC
SSDEEP:	24576:5sYXjV7IC9XCv2XKbz8sUP7yOpluyzUj0j8VYJsY1Yt:5sYXjVEC9XCv2XKbz8sUP7yOpluyzUjB

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
6808	2025-07-06_d2a270c20823ed225a7bd65d5bf4b85d_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5D04.tmp		executable
		MD5:515A2BBA54E789015FC3495F70CB73F7	SHA256:168CE267E3255D5BD0BEFEDE8E925FCA40272C7AC737453EB47C660912F1AB71
4192	5DCF.tmp	C:\Users\admin\AppData\Local\Temp\5E2D.tmp		executable
		MD5:2996353440BD7768415DD896AF7A8329	SHA256:736E26EF7CADB283539B65FBC96FEC15444CDD838210171E9F0EED69B1535B8F
2848	5D04.tmp	C:\Users\admin\AppData\Local\Temp\5D72.tmp		executable
		MD5:FABFF0FEA545A24ED8B076CF19B81731	SHA256:98CC980E66F5DF12097201C0F2307CF0AD9078D3C6B9D5D219B899B51F00AC74
2356	5E2D.tmp	C:\Users\admin\AppData\Local\Temp\5EBA.tmp		executable
		MD5:23CAC787E831425E8A5292ECB4867888	SHA256:32CF4CF48D45288925869C41B0BE5464BC9F190C6DB1B6CFDDE0EE2015F55596
3100	5D72.tmp	C:\Users\admin\AppData\Local\Temp\5DCF.tmp		executable
		MD5:E5D326CC36EB529D7E6F60E649F07AD2	SHA256:284567F5D7005251F7C7FD9858D7EF400E44CE4C17536B379FC8F5B1FBFCAD6A
2076	5F17.tmp	C:\Users\admin\AppData\Local\Temp\5F94.tmp		executable
		MD5:9453507B3A5FA9E9CB1697CD544EC384	SHA256:F11B62D387D55428B125712CA47FAF4EFE34F56F91006A8AB0B5992FCA7A6A9B
1356	5EBA.tmp	C:\Users\admin\AppData\Local\Temp\5F17.tmp		executable
		MD5:453570A783E9564B764488D99CE59247	SHA256:136DF14D6B38026AA0E42F02FC54A720AE1DD4DF9C47242E41C3536F1A0FE7F3
3780	5F94.tmp	C:\Users\admin\AppData\Local\Temp\6002.tmp		executable
		MD5:03638C63898E052271D6E29C6D5EB90A	SHA256:06EDDC32ED6A3F55ADCE0DBF039247292565897A2126E4BB6F219F6A29674268
2160	6002.tmp	C:\Users\admin\AppData\Local\Temp\6060.tmp		executable
		MD5:C3AC771DEAC16440DD0E2B3E760A43BF	SHA256:B5E3E98EB6AA0F1FDBC96AEB3CAD546FE29C0A3122EC0ED387C9007BFAC07311
4828	6060.tmp	C:\Users\admin\AppData\Local\Temp\60DD.tmp		executable
		MD5:A5367E40710FC55AAB845A92425777E7	SHA256:2685DD57C1D137C0D77FBD3C71549D7F2C8D28C7ACC7A321A916C54AB6AA5FFE

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	GET	304	172.202.163.200:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	—
—	—	GET	200	172.202.163.200:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	—
—	—	GET	200	2.23.246.101:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl	unknown	—	—	whitelisted
—	—	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl	unknown	—	—	whitelisted
—	—	GET	200	13.85.23.206:443	https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping	unknown	—	—	—
—	—	POST	200	20.190.160.132:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6828	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	2.20.245.137:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	2.20.245.137:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
6828	RUXIMICS.exe	2.20.245.137:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 20.73.194.208	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	2.20.245.137 2.20.245.139	whitelisted
www.microsoft.com	95.101.149.131 2.23.246.101	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
slscr.update.microsoft.com	52.149.20.212	whitelisted
login.live.com	20.190.160.4 40.126.32.74 40.126.32.133 20.190.160.2 20.190.160.65 20.190.160.3 40.126.32.76 40.126.32.134	whitelisted
fe3cr.delivery.mp.microsoft.com	20.3.187.198	whitelisted
self.events.data.microsoft.com	104.208.16.90	whitelisted

General Info

2025-07-06_d2a270c20823ed225a7bd65d5bf4b85d_elex_mafia_stealc_tofsee

D2A270C20823ED225A7BD65D5BF4B85D

CE25FD0C2A081A43802D4255262B98794EEB5123

53978E100FA4D620F3F87B11A32BFF5277F89B3A113F6A612D374CC60D34C6CC

24576:5sYXjV7IC9XCv2XKbz8sUP7yOpluyzUj0j8VYJsY1Yt:5sYXjVEC9XCv2XKbz8sUP7yOpluyzUjB

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings