File name:	2025-06-22_0aed04108fee3522cb554d3df9b9ccfa_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/292b58bd-658f-4c28-80c4-a5f71114b0d6
Verdict:	Malicious activity
Analysis date:	June 22, 2025, 01:04:53
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	0AED04108FEE3522CB554D3DF9B9CCFA
SHA1:	D441CE6871FBEED7DEB7E2B8A12D6AACAF83D020
SHA256:	BE2BD5A622EFFC6FFEAAD3E4FD788CAC47106FC719905F8A7DD8B677EB6822D5
SSDEEP:	24576:wsYXjV7ICZnVuJiwVs/WSiuaIDWfhOxyz:wsYXjVECZnVuJiwVs/WSpaIDWfhOxyz

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3640	6A52.tmp	C:\Users\admin\AppData\Local\Temp\6AB0.tmp		executable
		MD5:C32F4E214FAB5CA85DA93E59B328340D	SHA256:C8713BC5B29C147DE0F939A1B32D3E90AA6ABA92E4D7A8C60320DE80B131ED50
1484	6997.tmp	C:\Users\admin\AppData\Local\Temp\69F5.tmp		executable
		MD5:A0B5DAE1A95377998E91BF01DA3EBF97	SHA256:6A995791613C6E7E2210099D1FCCB3929B7D46E79BA36346A72E73714714D94C
7140	6C37.tmp	C:\Users\admin\AppData\Local\Temp\6C95.tmp		executable
		MD5:F078F3EC9FFF27810CD4F91C65A70E87	SHA256:54B61C1CB572F167BC400327DFBF34029FA6AC845B989A12EB9CCD45A7CB239C
1200	6C95.tmp	C:\Users\admin\AppData\Local\Temp\6CF2.tmp		executable
		MD5:94515CF687A78213158380E8E3C44040	SHA256:28A7C7595A24C1898877C73EDE8E1F10A46CD5BB64D8F49F8888135CC879ED6E
5372	6D60.tmp	C:\Users\admin\AppData\Local\Temp\6DBD.tmp		executable
		MD5:183D957B51FA03D505FBFEDD42F8379C	SHA256:A6F334A072DFEE2F77A0043A896D000BDCB171500AF747444EFD61444680CDEB
2716	6B0E.tmp	C:\Users\admin\AppData\Local\Temp\6B7B.tmp		executable
		MD5:CEC8C1FBD3972D3FD335C0617CCB5665	SHA256:8C69B7EE1A2524A88FF6357080B0AD70B88CF38C4554AA77E0625EE41F7BE0DF
2732	692A.tmp	C:\Users\admin\AppData\Local\Temp\6997.tmp		executable
		MD5:F5C3A4812C8BE626DA66072F02EC9A22	SHA256:C703493D5E56085A135C4AF9F5B36F25C1786757F4CEEB1D095F07F7BC4BF725
4192	69F5.tmp	C:\Users\admin\AppData\Local\Temp\6A52.tmp		executable
		MD5:8C13A0EC34BD8EEB34E6F5F403A1B596	SHA256:D4AF3442BE78BE97CAC8093CA55990D759A01D116ED42BD04E5DD9F5A1E7DC24
2028	6B7B.tmp	C:\Users\admin\AppData\Local\Temp\6BD9.tmp		executable
		MD5:51197EB9E92DBA63F8AF741F99A3ABCB	SHA256:5CE1B3CAD68088097198C03DDF81BB81756A4417E62A7527BC120FF8E903916D
6376	6BD9.tmp	C:\Users\admin\AppData\Local\Temp\6C37.tmp		executable
		MD5:AE4D5F3CAA6D878028A38840D9168AEC	SHA256:A8D58E5A52F38D4D7FFFBCB3FD587AEED8754A354193B8BC569BA5DD18E07964

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.53.40.178:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1812	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1812	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.53.40.178:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1812	RUXIMICS.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 40.127.240.158	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.53.40.178 23.53.40.176	whitelisted
www.microsoft.com	23.35.229.160	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	52.182.143.209	whitelisted

General Info

2025-06-22_0aed04108fee3522cb554d3df9b9ccfa_elex_mafia_stealc_tofsee

0AED04108FEE3522CB554D3DF9B9CCFA

D441CE6871FBEED7DEB7E2B8A12D6AACAF83D020

BE2BD5A622EFFC6FFEAAD3E4FD788CAC47106FC719905F8A7DD8B677EB6822D5

24576:wsYXjV7ICZnVuJiwVs/WSiuaIDWfhOxyz:wsYXjVECZnVuJiwVs/WSpaIDWfhOxyz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts itself from another location

Starts a Microsoft application from unusual location

Starts application with an unusual extension

Executable content was dropped or overwritten

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings