File name:	2025-07-06_7d50a0f64a02d6609d0c96b8638759a8_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/4d0a1e8e-4958-4ee5-aa21-b267d0509fb0
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 02:14:13
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	7D50A0F64A02D6609D0C96B8638759A8
SHA1:	6CD0029F7E66E2DFA7872CCE29989F505CCFA7B7
SHA256:	A2D6C6B065248ABB2D4AC2FA7282500A3F35A3A1A643DC33E40697FE8E38B037
SSDEEP:	24576:msYXjV7IC3EDgwRxb/EYJyzSCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:msYXjVEC3EUqxb/EYJyzSoq5TJLCvPDA

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1999:10:03 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3756	5E3D.tmp	C:\Users\admin\AppData\Local\Temp\5EBA.tmp		executable
		MD5:F75CB593D02597B0FEE44B1F206B2AA4	SHA256:EC8F27E64CE43078CAA50ECD8901FF76996F1FFA7AF7DFAF35E78967FDC2FB4E
7016	5EBA.tmp	C:\Users\admin\AppData\Local\Temp\5F37.tmp		executable
		MD5:A2E211BAC08DD35859FB7474C41EC97E	SHA256:2FF8912DF1BA31917A35BDB2660677C67B0F6F69D3814711541CB33F6F478AE0
4984	2025-07-06_7d50a0f64a02d6609d0c96b8638759a8_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5D72.tmp		executable
		MD5:3CE57A8BF0AF4005E09EF60FE871036C	SHA256:991234D3C76A094530D8AE8E57C0643122F36D9EC762CE4F5BF252FD7A44F8F8
5008	5F37.tmp	C:\Users\admin\AppData\Local\Temp\5FB4.tmp		executable
		MD5:6147E6DF7D4A9DD4DD5A9A328B7294DB	SHA256:F8E6276753FA005EBECD6C41CE4C4F270F466ED277F8C0290F8C301E869707CA
2220	5D72.tmp	C:\Users\admin\AppData\Local\Temp\5DDF.tmp		executable
		MD5:350C42BCBCDEAF81E272A41E30F9844F	SHA256:DFCB0ACA7D4699288AC4EB900F3EA63E09B5606BB0A5E35C1D5785BDFF2A2A19
1136	5DDF.tmp	C:\Users\admin\AppData\Local\Temp\5E3D.tmp		executable
		MD5:31F1E87800709982821581F456910DD5	SHA256:425BCC8CC416D775EEC5D73BFD7CE4371E50A4B75B0A8CE3EE43ED972D31C00F
2032	6ED7.tmp	C:\Users\admin\AppData\Local\Temp\6F34.tmp		executable
		MD5:E7AAA72115D052E416C43A6540CBAFEF	SHA256:732667333C65169942576FA5A29F4C9A1F5524BF89E76E2CEA013AC700B12FC3
6408	6C08.tmp	C:\Users\admin\AppData\Local\Temp\6C75.tmp		executable
		MD5:0DC8EA339F1B0328D5BEFBB7C05C81F4	SHA256:3A040FEA11A2F93C545C0BCD9B3802F1CCEE8E89C9DF0B3FF70C2319F69A50B8
1036	6D40.tmp	C:\Users\admin\AppData\Local\Temp\6DBD.tmp		executable
		MD5:A44B89F033B2EBB7C4DDD67FF49A3346	SHA256:44A9ACEDAF0DFBFB583381321B6B838AF7B43E28C3021419E26A0C069834FF49
3160	6CE3.tmp	C:\Users\admin\AppData\Local\Temp\6D40.tmp		executable
		MD5:C9F52BB53F2E234B33687A4D0D3C7D94	SHA256:3BC6A64DB074EA19FEFF84B24B85EA5812A023FBC1B9CAE88141565B9E1C9C48

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2764	RUXIMICS.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2764	RUXIMICS.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2764	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
2764	RUXIMICS.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
2764	RUXIMICS.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 4.231.128.59	whitelisted
google.com	142.250.186.110	whitelisted
crl.microsoft.com	23.216.77.28 23.216.77.6	whitelisted
www.microsoft.com	2.23.181.156	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	13.89.179.8	whitelisted

General Info

2025-07-06_7d50a0f64a02d6609d0c96b8638759a8_elex_mafia_stealc_tofsee

7D50A0F64A02D6609D0C96B8638759A8

6CD0029F7E66E2DFA7872CCE29989F505CCFA7B7

A2D6C6B065248ABB2D4AC2FA7282500A3F35A3A1A643DC33E40697FE8E38B037

24576:msYXjV7IC3EDgwRxb/EYJyzSCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:msYXjVEC3EUqxb/EYJyzSoq5TJLCvPDA

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Process drops legitimate windows executable

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings