File name:	2025-07-05_ffa11cf80599843f4577a508676725a0_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/d7af96e0-9e5f-45f6-831f-37a8b3996d11
Verdict:	Malicious activity
Analysis date:	July 05, 2025, 21:23:28
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	FFA11CF80599843F4577A508676725A0
SHA1:	918F1B131F4F4A035A0CCC572BE363CE78F0F2F1
SHA256:	79E48E8DA8674DE6A48276B2DB87776DE507D2B24391778EB2F51625C16256F6
SSDEEP:	24576:emsYXjV7ICE4yKipJ2qIG8HCi5axHxW2DNyz:lsYXjVECE4yKiT2qIG8HC+axRW2DNyz

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
6720	5AF1.tmp	C:\Users\admin\AppData\Local\Temp\5B5E.tmp		executable
		MD5:77DDFD9298CD4F9246089D9C71AAD915	SHA256:2D673F63057392531182EECCB4E5E2A94AE4BEC8CFBE7D0016550BF69E0247B9
4024	5C1A.tmp	C:\Users\admin\AppData\Local\Temp\5C78.tmp		executable
		MD5:822705E843763DBD0A1E175D524E702A	SHA256:056AD9912C2B663C68737AB0104EBBB2953008BD53E9D401AC26D4FB2B186ABC
2780	2025-07-05_ffa11cf80599843f4577a508676725a0_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5AF1.tmp		executable
		MD5:7C0408A3F46664F3EB180DF05D5F8EF0	SHA256:9DCD478F4C5686A6E7239CF42528772B0E4FBEB9488A8744769F4DA3BF2B77AB
6860	5BBC.tmp	C:\Users\admin\AppData\Local\Temp\5C1A.tmp		executable
		MD5:D934701D55288D14250A3F1A84031DD3	SHA256:3187252F520CCFCC5AF651D9C21C140713DCCAA0619050CE73E27FE325E2BCC3
1044	5B5E.tmp	C:\Users\admin\AppData\Local\Temp\5BBC.tmp		executable
		MD5:705C5818EA0B134D9B5698933231D5CC	SHA256:92AB13081F75DF110D2509A932FF9AB039ED15F7CE49B097ECC6825F809ACEB4
2716	5DA0.tmp	C:\Users\admin\AppData\Local\Temp\5DEF.tmp		executable
		MD5:9662419F278C8BB7A6B666DBE01A62BB	SHA256:14C1329E3967EAB1C0CB9C2367BDD64DBBB3598BE95A4148545B15C462294B3B
4264	5F37.tmp	C:\Users\admin\AppData\Local\Temp\5FB4.tmp		executable
		MD5:0BA2C7FEBAEBA70CBC0EBC8863A31846	SHA256:E21925D9C6DB38B01B0E6043D8D0A8569E4D7BE11297E61F31AB95D8DEC8A3EE
1484	5CD5.tmp	C:\Users\admin\AppData\Local\Temp\5D33.tmp		executable
		MD5:BA92A1538FFB9C992F0C98AD32B6F958	SHA256:3954EC88540749665020ABD7DBC46F11F3CF730928F7898A9C54BC37C8DC543E
7120	5C78.tmp	C:\Users\admin\AppData\Local\Temp\5CD5.tmp		executable
		MD5:3B4CCB498356537D85C3308966D42F8A	SHA256:262D978AD1349307A14E5BFB44204767F3E1E5ECC75BC07DC3AEA47954FBECF6
3924	5DEF.tmp	C:\Users\admin\AppData\Local\Temp\5E4C.tmp		executable
		MD5:06DA29937DA47087336BA1FCD0CB7B24	SHA256:5B3D719034836D07608F437CCEC42110EEA5E3C92B52448FF70B708C720557CC

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	2.16.168.124:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	2.16.168.124:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6404	RUXIMICS.exe	GET	200	2.16.168.124:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6404	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6404	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	2.16.168.124:80	crl.microsoft.com	Akamai International B.V.	RU	whitelisted
1268	svchost.exe	2.16.168.124:80	crl.microsoft.com	Akamai International B.V.	RU	whitelisted
6404	RUXIMICS.exe	2.16.168.124:80	crl.microsoft.com	Akamai International B.V.	RU	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 51.104.136.2	whitelisted
google.com	142.250.184.238	whitelisted
crl.microsoft.com	2.16.168.124 2.16.168.114	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	20.189.173.18	whitelisted

General Info

2025-07-05_ffa11cf80599843f4577a508676725a0_elex_mafia_stealc_tofsee

FFA11CF80599843F4577A508676725A0

918F1B131F4F4A035A0CCC572BE363CE78F0F2F1

79E48E8DA8674DE6A48276B2DB87776DE507D2B24391778EB2F51625C16256F6

24576:emsYXjV7ICE4yKipJ2qIG8HCi5axHxW2DNyz:lsYXjVECE4yKiT2qIG8HC+axRW2DNyz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings