File name:	2025-07-06_3a53fbea73d56d6d5e37bf9e0b022c03_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/b9a31cc3-229f-4cf1-8f0c-c64dd1341f04
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 02:06:50
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 13 sections
MD5:	3A53FBEA73D56D6D5E37BF9E0B022C03
SHA1:	54DF034FD6AB5595281C673E796304F77C5EF90E
SHA256:	ADA551A0458F4DFA11387E182850A7DB8A62639A5572242CC8E72795FC2E30C2
SSDEEP:	24576:dsYXjV7kCn3PtrvZIYGxL7zWGjpuBAVryzi73ctO:dsYXjVICn3PhRIYGxL7zWGjpuBAVryzd

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1995:08:25 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
316	5F66.tmp	C:\Users\admin\AppData\Local\Temp\5FC3.tmp		executable
		MD5:01C341B89291B4E81BC6D2C6F2FCB841	SHA256:71DE7B94B8FAEDAB71CF6FCFC4EBE490BDB21380AA391EEE8BB3368A1D0DC2C0
4984	2025-07-06_3a53fbea73d56d6d5e37bf9e0b022c03_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5EF8.tmp		executable
		MD5:9DA51669A53873620F0F6D74D5914D79	SHA256:1E1D1E9F1D13F9E0D1C50DC35F97F9BEB406A08CF4AF77BCDC6EB42742EE5EA9
6428	5EF8.tmp	C:\Users\admin\AppData\Local\Temp\5F66.tmp		executable
		MD5:15904A0556AE2BBEBFC931B12F465095	SHA256:5C9CF19A0035D640C37423DE2874CA2442916AEF3D63A8E8DE033A2794675923
4868	706D.tmp	C:\Users\admin\AppData\Local\Temp\70CB.tmp		executable
		MD5:C966F75A8F73EC555C7131D4C28B2FD2	SHA256:32A7A5A01AD87AC5E529878404B90C5C3D4B87B5F6E7D5E706B9C18783AC23FE
5352	65BF.tmp	C:\Users\admin\AppData\Local\Temp\6D8F.tmp		executable
		MD5:00D114761CF83D45F36876BE171E2F72	SHA256:5BED4900A549C68BB1E524AFC29B62E855043703E4FFC8F88F0689F8C141E5FB
1484	6198.tmp	C:\Users\admin\AppData\Local\Temp\6205.tmp		executable
		MD5:561BF810A64D23D0840303AE65EFF95E	SHA256:74130D5C050833BB3D91AA8BEB7E96628848C04C1E641907DA8FE0DFBE853494
3572	6551.tmp	C:\Users\admin\AppData\Local\Temp\65BF.tmp		executable
		MD5:DD2E3700F24B440AE53E3882A13585EF	SHA256:72CE4459FAA363E499A0101951739C72994D1F873B7DEF3743EACDD1845902F3
620	6D8F.tmp	C:\Users\admin\AppData\Local\Temp\706D.tmp		executable
		MD5:9C0875276EE388CC62549BE1EF122126	SHA256:717C11BBA1359425F284C9D46F9CFD6E8F484D977FD2DF5540790E593024703A
5104	64F3.tmp	C:\Users\admin\AppData\Local\Temp\6551.tmp		executable
		MD5:4F179F11B49E45BC25345897FC1FBC17	SHA256:ADCD498ED53DC305A4511D5A712D2E32DBAC3BDE5844BC1843DD0CC683462319
3608	70CB.tmp	C:\Users\admin\AppData\Local\Temp\7167.tmp		executable
		MD5:BE7AB72A6D84CE4AEB4D0C1B4818FBEA	SHA256:4199AFE2BCBEFB5D20F46E7CD4B6C3CB1DA88EB2975A1A83424A31C8AEAD6E7C

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
3588	RUXIMICS.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
3588	RUXIMICS.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	40.126.31.3:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	400	20.190.160.14:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	POST	400	20.190.160.128:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	POST	400	20.190.160.67:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
3588	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
3588	RUXIMICS.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 40.127.240.158	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.216.77.28 23.216.77.6 2.20.245.139 2.20.245.137	whitelisted
www.microsoft.com	2.23.181.156 95.101.149.131	whitelisted
login.live.com	40.126.32.138 40.126.32.133 20.190.160.17 20.190.160.3 20.190.160.2 20.190.160.132 20.190.160.128 20.190.160.66	whitelisted
nexusrules.officeapps.live.com	52.111.229.43	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	20.242.39.171	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
x1.c.lencr.org	2.16.252.233	whitelisted

General Info

2025-07-06_3a53fbea73d56d6d5e37bf9e0b022c03_elex_mafia_stealc_tofsee

3A53FBEA73D56D6D5E37BF9E0B022C03

54DF034FD6AB5595281C673E796304F77C5EF90E

ADA551A0458F4DFA11387E182850A7DB8A62639A5572242CC8E72795FC2E30C2

24576:dsYXjV7kCn3PtrvZIYGxL7zWGjpuBAVryzi73ctO:dsYXjVICn3PhRIYGxL7zWGjpuBAVryzd

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Executable content was dropped or overwritten

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Starts application with an unusual extension

Starts itself from another location

INFO

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings