File name:	2025-06-21_8f7b069bfe2b95cd1feaa1faa75c7047_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/e4cad668-89e4-4ef7-8c91-26a175bfea4f
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 04:08:14
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	8F7B069BFE2B95CD1FEAA1FAA75C7047
SHA1:	A50DC54DDA540034AF085215D62CCD81F964B3A2
SHA256:	C5E868FDAB566BAB3A01889F714B6CFF733BCB400AC6ED61CAA425567158B13F
SSDEEP:	24576:EsYXjV71C9qz6oeptJ0/9JR1ybLn+V7styzs:EsYXjV5C9qz6oeptJ0x1ybLn+V7wyzs

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
2044	704E.tmp	C:\Users\admin\AppData\Local\Temp\709C.tmp		executable
		MD5:0BD81E49022887267AE77972158969CE	SHA256:B1D462EA6C47BED2CF0E3525562BC45EBE746D061D0127A7430D1F05174554E1
2696	6CF2.tmp	C:\Users\admin\AppData\Local\Temp\6D50.tmp		executable
		MD5:DF00974E822E9654CE1873150E4E2731	SHA256:3971A83B23B7F4160D3087D97EFC7EA9E2809EE581071B53183A25BAD8D564FA
1520	2025-06-21_8f7b069bfe2b95cd1feaa1faa75c7047_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\6BBA.tmp		executable
		MD5:31939B27957BB674F27D49B51192E12F	SHA256:1363EEF2B73FEE05A599AEC3E5D449A21B3030A8D18658C90C22E91404DC275B
768	6C85.tmp	C:\Users\admin\AppData\Local\Temp\6CF2.tmp		executable
		MD5:0D9DFAA233B71DF9DB0ADB09BD63B3B3	SHA256:2A04F9F01A6BAE4E387CFC744D9D8C97AB882119A99E0A2C3A7326954669039B
1232	6E0C.tmp	C:\Users\admin\AppData\Local\Temp\6E98.tmp		executable
		MD5:2CECA665000B7B3EB7354CB499B8EDD7	SHA256:FF9900613422F99EB472757FFE6B1236A27345ABAFD4C5E8FBBE12E5AFEB8F5D
1356	6DAE.tmp	C:\Users\admin\AppData\Local\Temp\6E0C.tmp		executable
		MD5:54E5356A01656B622EEA0FE5034B3834	SHA256:10A60D1DC52320C9E7313B78064AE305FE4E5A42B336BBB7FCCBEFFB89D9E42C
3948	6F63.tmp	C:\Users\admin\AppData\Local\Temp\6FD1.tmp		executable
		MD5:E54890087E1B86B92B77CD8F7BE693CC	SHA256:B4682E8F50A515406B0DD0ABDCDCE0538259393A4415DBDEF9A11F207619DE68
3768	6F06.tmp	C:\Users\admin\AppData\Local\Temp\6F63.tmp		executable
		MD5:5D973B71529A144DDFE71B887584DD2F	SHA256:372396ECD765C60CC96263A0E596D4A043FC55A41C8BA251BFB1266982F065CD
6640	6BBA.tmp	C:\Users\admin\AppData\Local\Temp\6C27.tmp		executable
		MD5:2AAFDEE517119203CB02ADD8046D743C	SHA256:0FAA1038EF4085FC60207E6EB26B46A2F8FE2ECE0B9E10F4FE18D305028E7095
5528	6E98.tmp	C:\Users\admin\AppData\Local\Temp\6F06.tmp		executable
		MD5:DFA44B7557937655DCE955D1C44A173C	SHA256:1D1EA76E5EE76C708A7CBB926A7667F361CBFBDCD1F728A33326A4407B91AB51

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.53.40.178:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.53.40.178:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1480	RUXIMICS.exe	GET	200	23.53.40.178:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1480	RUXIMICS.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	304	52.149.20.212:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	—
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	GET	200	52.149.20.212:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	compressed	23.9 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1480	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.53.40.178:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.53.40.178:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1480	RUXIMICS.exe	23.53.40.178:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.53.40.178 23.53.40.176	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
self.events.data.microsoft.com	52.182.143.208	whitelisted
slscr.update.microsoft.com	52.149.20.212	whitelisted
fe3cr.delivery.mp.microsoft.com	13.85.23.206	whitelisted

General Info

2025-06-21_8f7b069bfe2b95cd1feaa1faa75c7047_elex_mafia_stealc_tofsee

8F7B069BFE2B95CD1FEAA1FAA75C7047

A50DC54DDA540034AF085215D62CCD81F964B3A2

C5E868FDAB566BAB3A01889F714B6CFF733BCB400AC6ED61CAA425567158B13F

24576:EsYXjV71C9qz6oeptJ0/9JR1ybLn+V7styzs:EsYXjV5C9qz6oeptJ0x1ybLn+V7wyzs

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings