File name:	2025-07-06_6718dee9c59a30137c086e78da7e9c97_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/bf4d86a6-75ba-4839-9985-0064a03ae903
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 02:27:00
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	6718DEE9C59A30137C086E78DA7E9C97
SHA1:	82CF27B2829752E39F73F89D6B117FCDE0CDE04C
SHA256:	91AD7789BD21C9BC5F4D0845521331B075F1711DB80D9FFB42ED0BA39EEC3A61
SSDEEP:	24576:c/sYXjV7ICod6W68WZnIjVvJr02PAoPn6yz:YsYXjVECod6W68WZnIjVvJr02PAoP6yz

.exe	\|	Generic Win/DOS Executable (50)
.exe	\|	DOS Executable Generic (49.9)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1800	2025-07-06_6718dee9c59a30137c086e78da7e9c97_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5E9A.tmp		executable
		MD5:14EE0D3C5D7A65382503FFD1CD5AD932	SHA256:A3187ED8C2121AE238D842B0E4D09FBE74B9D70689A8AA2651A394E4EB8E9BA1
1100	5F56.tmp	C:\Users\admin\AppData\Local\Temp\5FB4.tmp		executable
		MD5:79BE243CE4DCC3B3437AD6E597F7938C	SHA256:EC9379199AE77A2129A4EF49A9E8C9D85AF31D12CF608A6D55A2EEACC7E4F194
2976	5EF8.tmp	C:\Users\admin\AppData\Local\Temp\5F56.tmp		executable
		MD5:3D3758403F22F2A8C68E48D44876E83E	SHA256:ECA4D51A7B899B30704AA2D0C88CD87B763899E8F3B22762C0EBB0280C3E0A02
7160	60EC.tmp	C:\Users\admin\AppData\Local\Temp\614A.tmp		executable
		MD5:83DD31E4EC95D2489B7DDF8692D6D45E	SHA256:481E7973D02065E77C8F9EF52C9F29EE5BD0451A297BDCEC82D2B3FB11C7CD30
6656	5FB4.tmp	C:\Users\admin\AppData\Local\Temp\6031.tmp		executable
		MD5:64C32523995163186D8D250AC1DB3593	SHA256:54D669C72E8244EC2D8391447FFD14EEC3886DFDBB4C8B2CCFDFF210D1F45210
3620	639C.tmp	C:\Users\admin\AppData\Local\Temp\63F9.tmp		executable
		MD5:3B74F351733288BCDB3E23D25C1E8702	SHA256:91A2583F47C9124C4CF8F6A9E7476403C21DC8C78A702340EA786B06FA6820A5
4112	6273.tmp	C:\Users\admin\AppData\Local\Temp\62E0.tmp		executable
		MD5:BDBF1089BA08E5847C82B0A51A6839DB	SHA256:46B6D48A263ABF2E9B7B3EE303A00D208E867C3B1D4EE5A1EA85AD9BB8C333FA
5140	6542.tmp	C:\Users\admin\AppData\Local\Temp\6590.tmp		executable
		MD5:28618913D036AFB2526F8A11465D5E1B	SHA256:A57E5EEFBC76FF395840CBA8C90A4A3D4C71F3526BEBEB8F6F8D9D5A08BFE1E1
6724	63F9.tmp	C:\Users\admin\AppData\Local\Temp\6457.tmp		executable
		MD5:089C4DF46B12308C5EC0B327A043950C	SHA256:EF4D7A5CB79C41EF1F1B20B89D874DEA353E4863F881ED4FA4B949B70AF17D36
5884	64E4.tmp	C:\Users\admin\AppData\Local\Temp\6542.tmp		executable
		MD5:049036D1C3E38B942EDDC768FDE23251	SHA256:C0E93D526400D2AF851849910D8DBC6D7DFB9B02AAF2ABD8105FAB7C630154F6

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
3688	RUXIMICS.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.52.120.96:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.52.120.96:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
3688	RUXIMICS.exe	GET	200	23.52.120.96:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3688	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
3688	RUXIMICS.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.52.120.96:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
3688	RUXIMICS.exe	23.52.120.96:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.216.77.28 23.216.77.6	whitelisted
www.microsoft.com	23.52.120.96	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	20.42.65.94	whitelisted

General Info

2025-07-06_6718dee9c59a30137c086e78da7e9c97_elex_mafia_stealc_tofsee

6718DEE9C59A30137C086E78DA7E9C97

82CF27B2829752E39F73F89D6B117FCDE0CDE04C

91AD7789BD21C9BC5F4D0845521331B075F1711DB80D9FFB42ED0BA39EEC3A61

24576:c/sYXjV7ICod6W68WZnIjVvJr02PAoPn6yz:YsYXjVECod6W68WZnIjVvJr02PAoP6yz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings