File name:	2025-07-06_6718dee9c59a30137c086e78da7e9c97_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/bf4d86a6-75ba-4839-9985-0064a03ae903
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 02:27:00
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	6718DEE9C59A30137C086E78DA7E9C97
SHA1:	82CF27B2829752E39F73F89D6B117FCDE0CDE04C
SHA256:	91AD7789BD21C9BC5F4D0845521331B075F1711DB80D9FFB42ED0BA39EEC3A61
SSDEEP:	24576:c/sYXjV7ICod6W68WZnIjVvJr02PAoPn6yz:YsYXjVECod6W68WZnIjVvJr02PAoP6yz

.exe	\|	Generic Win/DOS Executable (50)
.exe	\|	DOS Executable Generic (49.9)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1800	2025-07-06_6718dee9c59a30137c086e78da7e9c97_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5E9A.tmp		executable
		MD5:14EE0D3C5D7A65382503FFD1CD5AD932	SHA256:A3187ED8C2121AE238D842B0E4D09FBE74B9D70689A8AA2651A394E4EB8E9BA1
6420	5E9A.tmp	C:\Users\admin\AppData\Local\Temp\5EF8.tmp		executable
		MD5:5568A99FA7D931DADBB73E3470C0A2B0	SHA256:60C7B756768C4EC480A9F416450C82F28A0E336EC3D1C1F9588BB1875F7EBAC3
1100	5F56.tmp	C:\Users\admin\AppData\Local\Temp\5FB4.tmp		executable
		MD5:79BE243CE4DCC3B3437AD6E597F7938C	SHA256:EC9379199AE77A2129A4EF49A9E8C9D85AF31D12CF608A6D55A2EEACC7E4F194
6656	5FB4.tmp	C:\Users\admin\AppData\Local\Temp\6031.tmp		executable
		MD5:64C32523995163186D8D250AC1DB3593	SHA256:54D669C72E8244EC2D8391447FFD14EEC3886DFDBB4C8B2CCFDFF210D1F45210
4156	614A.tmp	C:\Users\admin\AppData\Local\Temp\61B7.tmp		executable
		MD5:E8028CB930635189DD8CD8E4F70DB9BF	SHA256:E1914E8040216F91E9F96FBB0A4EB96D122D5217E7027925ED4BCF2E502C9807
7160	60EC.tmp	C:\Users\admin\AppData\Local\Temp\614A.tmp		executable
		MD5:83DD31E4EC95D2489B7DDF8692D6D45E	SHA256:481E7973D02065E77C8F9EF52C9F29EE5BD0451A297BDCEC82D2B3FB11C7CD30
5576	6031.tmp	C:\Users\admin\AppData\Local\Temp\608E.tmp		executable
		MD5:D3F4A661C9ED0BE9CF054ED7D23A563C	SHA256:8DD69FBB4ABE7046C51C919A5FF7281F579F1EDCDEB3007EE06193945EF1151D
5780	608E.tmp	C:\Users\admin\AppData\Local\Temp\60EC.tmp		executable
		MD5:8338331D98922E577BC44F869CC445D9	SHA256:BFE400F63680520DE8AFB92F2CFE737A1503752A550CDA7DFBD0DC718172FF5B
4800	61B7.tmp	C:\Users\admin\AppData\Local\Temp\6215.tmp		executable
		MD5:100BC962C3D59A6C441397631BC0DEEC	SHA256:C76D8E2FEC6AB6FDF78591FA480753B14E99B91D8EDBFD6472DB758F4C2252A6
2976	5EF8.tmp	C:\Users\admin\AppData\Local\Temp\5F56.tmp		executable
		MD5:3D3758403F22F2A8C68E48D44876E83E	SHA256:ECA4D51A7B899B30704AA2D0C88CD87B763899E8F3B22762C0EBB0280C3E0A02

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3688	RUXIMICS.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
3688	RUXIMICS.exe	GET	200	23.52.120.96:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.52.120.96:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.52.120.96:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3688	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
3688	RUXIMICS.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.52.120.96:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
3688	RUXIMICS.exe	23.52.120.96:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.216.77.28 23.216.77.6	whitelisted
www.microsoft.com	23.52.120.96	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	20.42.65.94	whitelisted

General Info

2025-07-06_6718dee9c59a30137c086e78da7e9c97_elex_mafia_stealc_tofsee

6718DEE9C59A30137C086E78DA7E9C97

82CF27B2829752E39F73F89D6B117FCDE0CDE04C

91AD7789BD21C9BC5F4D0845521331B075F1711DB80D9FFB42ED0BA39EEC3A61

24576:c/sYXjV7ICod6W68WZnIjVvJr02PAoPn6yz:YsYXjVECod6W68WZnIjVvJr02PAoP6yz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Starts itself from another location

Starts application with an unusual extension

Executable content was dropped or overwritten

INFO

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings