File name:	2025-06-22_0aed04108fee3522cb554d3df9b9ccfa_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/292b58bd-658f-4c28-80c4-a5f71114b0d6
Verdict:	Malicious activity
Analysis date:	June 22, 2025, 01:04:53
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	0AED04108FEE3522CB554D3DF9B9CCFA
SHA1:	D441CE6871FBEED7DEB7E2B8A12D6AACAF83D020
SHA256:	BE2BD5A622EFFC6FFEAAD3E4FD788CAC47106FC719905F8A7DD8B677EB6822D5
SSDEEP:	24576:wsYXjV7ICZnVuJiwVs/WSiuaIDWfhOxyz:wsYXjVECZnVuJiwVs/WSpaIDWfhOxyz

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
5020	2025-06-22_0aed04108fee3522cb554d3df9b9ccfa_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\68BC.tmp		executable
		MD5:69D7B1B0A578D904D2FE05A704E3D5BC	SHA256:F7C713CBB13FFAAAAF13774F625864A91EE42F379B29DF032485FC408A6C2C95
6376	6BD9.tmp	C:\Users\admin\AppData\Local\Temp\6C37.tmp		executable
		MD5:AE4D5F3CAA6D878028A38840D9168AEC	SHA256:A8D58E5A52F38D4D7FFFBCB3FD587AEED8754A354193B8BC569BA5DD18E07964
4192	69F5.tmp	C:\Users\admin\AppData\Local\Temp\6A52.tmp		executable
		MD5:8C13A0EC34BD8EEB34E6F5F403A1B596	SHA256:D4AF3442BE78BE97CAC8093CA55990D759A01D116ED42BD04E5DD9F5A1E7DC24
7140	6C37.tmp	C:\Users\admin\AppData\Local\Temp\6C95.tmp		executable
		MD5:F078F3EC9FFF27810CD4F91C65A70E87	SHA256:54B61C1CB572F167BC400327DFBF34029FA6AC845B989A12EB9CCD45A7CB239C
6360	6AB0.tmp	C:\Users\admin\AppData\Local\Temp\6B0E.tmp		executable
		MD5:9F69217464FCC90FC9A2676536FE1D15	SHA256:89686CD5067A975B82F497209C623D89A347B1DBC9139EC149F5EB73BB50F6D6
6232	6E1B.tmp	C:\Users\admin\AppData\Local\Temp\6E79.tmp		executable
		MD5:5B311054E1168230C3E85FCCC3BBE2E3	SHA256:A5493F79427E7FEC555CE4DEFAF60640948D58E12F77814A1B2E600B2BE837F5
4868	6CF2.tmp	C:\Users\admin\AppData\Local\Temp\6D60.tmp		executable
		MD5:D9BFB49E26784572883FDABCD90F6B5D	SHA256:3E1BC771B913181D0FF249F77E86BCCB3CC1D4E5B601989EE13D95D09639E6E8
6336	6DBD.tmp	C:\Users\admin\AppData\Local\Temp\6E1B.tmp		executable
		MD5:18CFA2E9A0AE143DC0C625FB81CEC495	SHA256:AF438B0CD77B088A0721B36C4A85497624D84C52BBD063646FA78B6CD1BED213
5780	6F25.tmp	C:\Users\admin\AppData\Local\Temp\6F92.tmp		executable
		MD5:AD3939201632CD8A9405E09142693B35	SHA256:366EEC9B2FCB2C6E2A201246DF7D12B29ADE8E83CC83E236095E4DC6B9CE9D5B
6636	6EC7.tmp	C:\Users\admin\AppData\Local\Temp\6F25.tmp		executable
		MD5:2654ECDE40E9BDC9FF7D121ED640AD3C	SHA256:6765703708914211D8C44AE69D06D72FE0CFEE1CE25910796DC9B43D3E8F534D

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.53.40.178:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1812	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1812	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.53.40.178:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1812	RUXIMICS.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 40.127.240.158	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.53.40.178 23.53.40.176	whitelisted
www.microsoft.com	23.35.229.160	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	52.182.143.209	whitelisted

General Info

2025-06-22_0aed04108fee3522cb554d3df9b9ccfa_elex_mafia_stealc_tofsee

0AED04108FEE3522CB554D3DF9B9CCFA

D441CE6871FBEED7DEB7E2B8A12D6AACAF83D020

BE2BD5A622EFFC6FFEAAD3E4FD788CAC47106FC719905F8A7DD8B677EB6822D5

24576:wsYXjV7ICZnVuJiwVs/WSiuaIDWfhOxyz:wsYXjVECZnVuJiwVs/WSpaIDWfhOxyz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings