File name:	2025-07-06_7d50a0f64a02d6609d0c96b8638759a8_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/4d0a1e8e-4958-4ee5-aa21-b267d0509fb0
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 02:14:13
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	7D50A0F64A02D6609D0C96B8638759A8
SHA1:	6CD0029F7E66E2DFA7872CCE29989F505CCFA7B7
SHA256:	A2D6C6B065248ABB2D4AC2FA7282500A3F35A3A1A643DC33E40697FE8E38B037
SSDEEP:	24576:msYXjV7IC3EDgwRxb/EYJyzSCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:msYXjVEC3EUqxb/EYJyzSoq5TJLCvPDA

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1999:10:03 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
4984	2025-07-06_7d50a0f64a02d6609d0c96b8638759a8_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5D72.tmp		executable
		MD5:3CE57A8BF0AF4005E09EF60FE871036C	SHA256:991234D3C76A094530D8AE8E57C0643122F36D9EC762CE4F5BF252FD7A44F8F8
424	607F.tmp	C:\Users\admin\AppData\Local\Temp\66D8.tmp		executable
		MD5:784FADBA52C605DE81500F18EC2D60CB	SHA256:DADFA81EF231EDEC27EA89D591C94599E11AF901971B01CF69CE16D6DC95C17D
3160	6CE3.tmp	C:\Users\admin\AppData\Local\Temp\6D40.tmp		executable
		MD5:C9F52BB53F2E234B33687A4D0D3C7D94	SHA256:3BC6A64DB074EA19FEFF84B24B85EA5812A023FBC1B9CAE88141565B9E1C9C48
3656	6B3D.tmp	C:\Users\admin\AppData\Local\Temp\6B9B.tmp		executable
		MD5:F9E265FA43A292C50E3F5650DB1374F5	SHA256:9021213C43778FC0C8DEAE8638885CD68960BEA5D96D392452D414FA7DFBCE9D
6016	5FB4.tmp	C:\Users\admin\AppData\Local\Temp\6011.tmp		executable
		MD5:5FA7F95C840953F5A6F3A3D684932913	SHA256:304BAE6893B144522913EDDFEFD39D4FEA4A44ECC02CE28DA99BFA5FA83AC805
1036	6D40.tmp	C:\Users\admin\AppData\Local\Temp\6DBD.tmp		executable
		MD5:A44B89F033B2EBB7C4DDD67FF49A3346	SHA256:44A9ACEDAF0DFBFB583381321B6B838AF7B43E28C3021419E26A0C069834FF49
5612	6C75.tmp	C:\Users\admin\AppData\Local\Temp\6CE3.tmp		executable
		MD5:9A1B8927AE4A77C591B5726939521F9F	SHA256:AA878748271832E0792B0F06B9E761E6BBC684CBDF056B456EAE5C446894A5CD
4500	6011.tmp	C:\Users\admin\AppData\Local\Temp\607F.tmp		executable
		MD5:785ECBB745F22386F3270FC5BC397EF2	SHA256:40C57D48A6EA245373E339E1C75498C22C3DC791BF8F13225CDDD503E47800CA
7016	5EBA.tmp	C:\Users\admin\AppData\Local\Temp\5F37.tmp		executable
		MD5:A2E211BAC08DD35859FB7474C41EC97E	SHA256:2FF8912DF1BA31917A35BDB2660677C67B0F6F69D3814711541CB33F6F478AE0
3704	6B9B.tmp	C:\Users\admin\AppData\Local\Temp\6C08.tmp		executable
		MD5:5B6ED3647A945A8F3DD0AE26A3066397	SHA256:C2D09D5BBC2837730869479F60BDC307750F65F31892A2B1E455B80268B7A498

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2764	RUXIMICS.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2764	RUXIMICS.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2764	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
2764	RUXIMICS.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
2764	RUXIMICS.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 4.231.128.59	whitelisted
google.com	142.250.186.110	whitelisted
crl.microsoft.com	23.216.77.28 23.216.77.6	whitelisted
www.microsoft.com	2.23.181.156	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	13.89.179.8	whitelisted

General Info

2025-07-06_7d50a0f64a02d6609d0c96b8638759a8_elex_mafia_stealc_tofsee

7D50A0F64A02D6609D0C96B8638759A8

6CD0029F7E66E2DFA7872CCE29989F505CCFA7B7

A2D6C6B065248ABB2D4AC2FA7282500A3F35A3A1A643DC33E40697FE8E38B037

24576:msYXjV7IC3EDgwRxb/EYJyzSCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:msYXjVEC3EUqxb/EYJyzSoq5TJLCvPDA

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Starts itself from another location

Executable content was dropped or overwritten

Starts application with an unusual extension

Process drops legitimate windows executable

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings