File name:	2025-06-21_0a77724df2c87512ed71cd668293a2ff_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/3f1234cd-8129-45a7-a6d1-73b9dd591a98
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 11:54:48
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	0A77724DF2C87512ED71CD668293A2FF
SHA1:	FB8F9797388B9354DC998165FB098B5DFBBDA12C
SHA256:	E32F013DB2AEDBB5E5DA4E2112ED0FF903AFD3B38E41B729728758093EC11EFC
SSDEEP:	24576:msYXjV7ICD2biIw6VlGF3AXQDlYzcjxpG5A/ZfyzSCvq5TJLCvY90D8/LVBlVk7k:msYXjVECD2biIw6VlGF3AXQDlYEx85Ap

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1999:10:03 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
7048	6BC9.tmp	C:\Users\admin\AppData\Local\Temp\6C46.tmp		executable
		MD5:1E293CC608E62CEC88A19CA1AE109D7A	SHA256:E88DB938877AA823C9C9EA9B26C31B5D773171DEC1797BC9DE3C3EFC05E33BF7
3100	6AFE.tmp	C:\Users\admin\AppData\Local\Temp\6B6C.tmp		executable
		MD5:DF15B2A2C3DD4B1019C236EE70667825	SHA256:4E125BF51E9AB536496DDB8E91182F627730C50E090BFA998D6387912F013608
1688	6C46.tmp	C:\Users\admin\AppData\Local\Temp\6CA4.tmp		executable
		MD5:CDBC0A046EE51D833AD7C1D35B487CAD	SHA256:6BB585F957EFA3EE8762CE8435E62F56A8D6BA156F572AF9A3C7FD641985E493
1216	6D12.tmp	C:\Users\admin\AppData\Local\Temp\6D9E.tmp		executable
		MD5:093380C28C1060DC45ECBCA9471EEC36	SHA256:20C0B02E3DDB5048904665ED6D7193CF2847EF3921C59EC4B0EE6C4540B56A16
6656	6B6C.tmp	C:\Users\admin\AppData\Local\Temp\6BC9.tmp		executable
		MD5:5AA643F12AD7D048ED24C4C2875504B3	SHA256:60E256A649C83A65B0911F29922D1A2643398A0906A5D1D813A9895B7E26401F
2976	6987.tmp	C:\Users\admin\AppData\Local\Temp\69F5.tmp		executable
		MD5:2E72B953805CC5B6843F0D537A13835A	SHA256:6C090A7D555CF51A1EFB1E5EF9180B1E7DAB3C919BD9DFD535E69D204CEDAB8E
1644	6CA4.tmp	C:\Users\admin\AppData\Local\Temp\6D12.tmp		executable
		MD5:A25AE1093000492BE2B425184C97E53A	SHA256:1AC70C4CFEC9CBFE29EABE2017EC1DA9E61DD42C31C288642DDF1051548822C1
6940	7000.tmp	C:\Users\admin\AppData\Local\Temp\7109.tmp		executable
		MD5:5584B4B669ABC9C1B250D45FDF5DC256	SHA256:B24C179223FA08EAE847C380BF22B0D7416552FAA2026B1FF1161A08A5CC10D7
1332	6E1B.tmp	C:\Users\admin\AppData\Local\Temp\6EA8.tmp		executable
		MD5:A71A0031E4AB3460C4D1951EFBC10DDD	SHA256:D4047356B01E6131199B6E284632474E810CBAD34C448C21715C85CAD25D5EF7
4664	6EA8.tmp	C:\Users\admin\AppData\Local\Temp\6F44.tmp		executable
		MD5:EDCB79863791E8492A42B6D2116A59F2	SHA256:B229C9E77104C9AE67C715D6EAEE7BF8C37B5A7FE209D7F3D57B617691570A59

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	184.24.77.37:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1812	RUXIMICS.exe	GET	200	184.24.77.37:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	184.24.77.37:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1812	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1812	RUXIMICS.exe	51.104.136.2:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	51.104.136.2:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	184.24.77.37:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.24.77.37:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1812	RUXIMICS.exe	184.24.77.37:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
google.com	142.250.186.142	whitelisted
crl.microsoft.com	184.24.77.37 184.24.77.39 184.24.77.40 184.24.77.33 184.24.77.34 184.24.77.36 184.24.77.7 184.24.77.9 184.24.77.6	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
settings-win.data.microsoft.com	51.124.78.146	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	52.168.112.67	whitelisted

General Info

2025-06-21_0a77724df2c87512ed71cd668293a2ff_elex_mafia_stealc_tofsee

0A77724DF2C87512ED71CD668293A2FF

FB8F9797388B9354DC998165FB098B5DFBBDA12C

E32F013DB2AEDBB5E5DA4E2112ED0FF903AFD3B38E41B729728758093EC11EFC

24576:msYXjV7ICD2biIw6VlGF3AXQDlYzcjxpG5A/ZfyzSCvq5TJLCvY90D8/LVBlVk7k:msYXjVECD2biIw6VlGF3AXQDlYEx85Ap

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Starts itself from another location

Executable content was dropped or overwritten

Starts application with an unusual extension

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings