File name:	2025-07-06_3a53fbea73d56d6d5e37bf9e0b022c03_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/b9a31cc3-229f-4cf1-8f0c-c64dd1341f04
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 02:06:50
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 13 sections
MD5:	3A53FBEA73D56D6D5E37BF9E0B022C03
SHA1:	54DF034FD6AB5595281C673E796304F77C5EF90E
SHA256:	ADA551A0458F4DFA11387E182850A7DB8A62639A5572242CC8E72795FC2E30C2
SSDEEP:	24576:dsYXjV7kCn3PtrvZIYGxL7zWGjpuBAVryzi73ctO:dsYXjVICn3PhRIYGxL7zWGjpuBAVryzd

.exe	\|	Win64 Executable (generic) (64.6)
.dll	\|	Win32 Dynamic Link Library (generic) (15.4)
.exe	\|	Win32 Executable (generic) (10.5)
.exe	\|	Generic Win/DOS Executable (4.6)
.exe	\|	DOS Executable Generic (4.6)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1995:08:25 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
316	5F66.tmp	C:\Users\admin\AppData\Local\Temp\5FC3.tmp		executable
		MD5:01C341B89291B4E81BC6D2C6F2FCB841	SHA256:71DE7B94B8FAEDAB71CF6FCFC4EBE490BDB21380AA391EEE8BB3368A1D0DC2C0
4024	6021.tmp	C:\Users\admin\AppData\Local\Temp\608E.tmp		executable
		MD5:72DC085925EE1C30A2CFE484AD2CC516	SHA256:484900875D1BDEF5AA4AC62904CC4E73A5488BCFC94C270803F6BA20E60E970D
4984	2025-07-06_3a53fbea73d56d6d5e37bf9e0b022c03_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\5EF8.tmp		executable
		MD5:9DA51669A53873620F0F6D74D5914D79	SHA256:1E1D1E9F1D13F9E0D1C50DC35F97F9BEB406A08CF4AF77BCDC6EB42742EE5EA9
6428	5EF8.tmp	C:\Users\admin\AppData\Local\Temp\5F66.tmp		executable
		MD5:15904A0556AE2BBEBFC931B12F465095	SHA256:5C9CF19A0035D640C37423DE2874CA2442916AEF3D63A8E8DE033A2794675923
5808	5FC3.tmp	C:\Users\admin\AppData\Local\Temp\6021.tmp		executable
		MD5:14E980CDC7A244DBC54C5355DFE99917	SHA256:B200ECE761BDB2BECE5829143334DE7B2F60E0A648A2779B22634366AD78C326
6124	60EC.tmp	C:\Users\admin\AppData\Local\Temp\614A.tmp		executable
		MD5:8AFA36A8CC3F132255458F2E2F5CFCB0	SHA256:A6BF52216AC03813B250FF0E32EBC42347F5AEFFE721838DEC07FBAF3AD41A85
5712	614A.tmp	C:\Users\admin\AppData\Local\Temp\6198.tmp		executable
		MD5:16434A3D49E2C4B1E0AB4CE934E098B8	SHA256:139B893BCD0D608445A4884D3B4F415E98EBC16DC0150FE0E61ECDC1178DEF1A
1356	608E.tmp	C:\Users\admin\AppData\Local\Temp\60EC.tmp		executable
		MD5:B5D5AEE61A1B08BA723B21F9689B1537	SHA256:0892E2502CADB27F28C70892F9BC526116925F5848B0DA7E472FC1170E1BE4D1
1484	6198.tmp	C:\Users\admin\AppData\Local\Temp\6205.tmp		executable
		MD5:561BF810A64D23D0840303AE65EFF95E	SHA256:74130D5C050833BB3D91AA8BEB7E96628848C04C1E641907DA8FE0DFBE853494
320	6263.tmp	C:\Users\admin\AppData\Local\Temp\62B1.tmp		executable
		MD5:6E2CE556B9E6AD1D05AEC3111970140E	SHA256:F8524549D0FC48277286C931A7F4DACD3F1947EE4478C40BB776A37B2ADF7304

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
3588	RUXIMICS.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
1268	svchost.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
3588	RUXIMICS.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
—	—	POST	400	20.190.160.14:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
1268	svchost.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
—	—	POST	400	20.190.160.67:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	—	—	whitelisted
—	—	POST	200	40.126.31.3:443	https://login.live.com/RST2.srf	US	xml	1.24 Kb	whitelisted
—	—	POST	400	20.190.160.128:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
3588	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
3588	RUXIMICS.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 40.127.240.158	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.216.77.28 23.216.77.6 2.20.245.139 2.20.245.137	whitelisted
www.microsoft.com	2.23.181.156 95.101.149.131	whitelisted
login.live.com	40.126.32.138 40.126.32.133 20.190.160.17 20.190.160.3 20.190.160.2 20.190.160.132 20.190.160.128 20.190.160.66	whitelisted
nexusrules.officeapps.live.com	52.111.229.43	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	20.242.39.171	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
x1.c.lencr.org	2.16.252.233	whitelisted

General Info

2025-07-06_3a53fbea73d56d6d5e37bf9e0b022c03_elex_mafia_stealc_tofsee

3A53FBEA73D56D6D5E37BF9E0B022C03

54DF034FD6AB5595281C673E796304F77C5EF90E

ADA551A0458F4DFA11387E182850A7DB8A62639A5572242CC8E72795FC2E30C2

24576:dsYXjV7kCn3PtrvZIYGxL7zWGjpuBAVryzi73ctO:dsYXjVICn3PhRIYGxL7zWGjpuBAVryzd

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts application with an unusual extension

Starts itself from another location

INFO

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings