File name:	2025-06-21_a8c3657c0de188ca73e3d1f424340a20_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/2975caa8-b785-49fb-adab-76f94005005a
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 12:39:16
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	A8C3657C0DE188CA73E3D1F424340A20
SHA1:	91211A0A416412C08FE9FC4F3C526D4EEE2356C8
SHA256:	D044E974429B46F322CA7CD2585860E9F86CCB90BC2FB67FE0F6EA345968A1F0
SSDEEP:	12288:EsYXHjErS5EWEc59eAC9DSJNM1W7Xv2vzlyhBdKqup+2f4rVVh6yzRu:EsYXjV71C9DSv+gXv2vJy9KqupZ4wyzs

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3864	6A04.tmp	C:\Users\admin\AppData\Local\Temp\6A81.tmp		executable
		MD5:F9C1F202B4C378A718A64C70756C9029	SHA256:FA0DABFCD504D2B75211419A93C6B37204B71362D217FABD99462E6C86198EAF
4648	6B6C.tmp	C:\Users\admin\AppData\Local\Temp\6BD9.tmp		executable
		MD5:4D07A5E2AA4C3D5F106DAE57D6653BED	SHA256:69CA7D8F2532813D77151A748D301CEA40F95B45BD863E42682E97164B0AD8DC
1484	2025-06-21_a8c3657c0de188ca73e3d1f424340a20_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\6A04.tmp		executable
		MD5:F3AE692DDD16FB8911C15D1D4C68C1C7	SHA256:11AE2048569CC60981BE9C79A067E66D298C1DAA3D1A51D577B44355AB74A8D8
4456	6C37.tmp	C:\Users\admin\AppData\Local\Temp\6C95.tmp		executable
		MD5:F7E3EBC666C9E50EE2483054A44D8BCD	SHA256:3D1853FB9B66CAF4B761386171DA74446EBB12856956AEFFFC46E34D1FB195A2
6700	6BD9.tmp	C:\Users\admin\AppData\Local\Temp\6C37.tmp		executable
		MD5:9E5E24CCB27D74AABD0857593B733646	SHA256:454AFD56D848D8E34B45C948A8AB121E6CB5C5DE28FBE5DDDF18B86E2C5B1D77
2596	6C95.tmp	C:\Users\admin\AppData\Local\Temp\6D02.tmp		executable
		MD5:38CF8C7B87C9ABD76DEB13DB438A6313	SHA256:4232E037AE6879944BB3269C91F88AD9624DDCDFB6164C530E8591D3B5179F78
5080	6D02.tmp	C:\Users\admin\AppData\Local\Temp\6D60.tmp		executable
		MD5:A6C7F573F508C0E2294684F7427DB331	SHA256:1DC374A3D519F807C1F3825A7AA6C1A22296574F607EC8F304A984EE24A60246
1496	6A81.tmp	C:\Users\admin\AppData\Local\Temp\6AEF.tmp		executable
		MD5:FEAD8F5CB98C7E63C615A2866B5059D5	SHA256:D211883FE2C5B1B92F881751EEFB3CA1805039A0F89494752BA52F683C75E7B2
6548	6AEF.tmp	C:\Users\admin\AppData\Local\Temp\6B6C.tmp		executable
		MD5:DE51E281D365335335593349E6F67135	SHA256:3E85201F038E84A53869479B9E5AB36D0120D4380DA5F1ED1767D35A41FCEB1C
4768	70BB.tmp	C:\Users\admin\AppData\Local\Temp\7148.tmp		executable
		MD5:9BFD4A8335CF536D39918E2BEFE1C547	SHA256:6D817EE659A1D2FAC77C454860EF19FD2CE1B71119EC25A74FADEF03441FD86C

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2664	RUXIMICS.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2664	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1268	svchost.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
2664	RUXIMICS.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 40.127.240.158	whitelisted
google.com	172.217.16.142	whitelisted
crl.microsoft.com	23.55.104.172 23.55.104.190	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	20.189.173.27	whitelisted

General Info

2025-06-21_a8c3657c0de188ca73e3d1f424340a20_elex_mafia_stealc_tofsee

A8C3657C0DE188CA73E3D1F424340A20

91211A0A416412C08FE9FC4F3C526D4EEE2356C8

D044E974429B46F322CA7CD2585860E9F86CCB90BC2FB67FE0F6EA345968A1F0

12288:EsYXHjErS5EWEc59eAC9DSJNM1W7Xv2vzlyhBdKqup+2f4rVVh6yzRu:EsYXjV71C9DSv+gXv2vJy9KqupZ4wyzs

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Reads the machine GUID from the registry

Checks supported languages

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings