File name:	2025-06-21_e8b0b3e87ffb775b93075db96c4c4c82_elex_mafia_stealc_tofsee
Full analysis:	https://app.any.run/tasks/c735a690-f470-423c-9444-3e5063241f2f
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 10:55:27
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	E8B0B3E87FFB775B93075DB96C4C4C82
SHA1:	06CD2EBD51F3666A576350666DF487177500600D
SHA256:	E3CEEE3A139CC120108E50F57AF99BEAA39E9576E06242DC6461D9C9FD9DE77F
SSDEEP:	24576:msYXjV7ICQIyIcOUM/BFKyqOKbDiUIV1yiyzSCvq5TJLCvY90D8/LVBlVk736Y7k:msYXjVECQIyIcOUM/BFKyqOKbDiBVUiH

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1999:10:03 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
5168	6F15.tmp	C:\Users\admin\AppData\Local\Temp\6F73.tmp		executable
		MD5:E2BD975BA0D2096EC4911B47A59ED779	SHA256:3E3904EB067374E5B0C3BA455BBA5245C46F6D823801E5339D902965A73C82EA
6268	6EC7.tmp	C:\Users\admin\AppData\Local\Temp\6F15.tmp		executable
		MD5:81E7EF873F39F151C65384CE664525F5	SHA256:56B1AB82E62DEA6C5056F0F6E2CCCE4B9E8545718AAC3B8E195AB9C4ADE7B05C
1200	70BB.tmp	C:\Users\admin\AppData\Local\Temp\7119.tmp		executable
		MD5:F2BEF2CB92C8CB7156DBD19972DA56DB	SHA256:030A742809CF8DC6B7703912EE4AA2070DABD8DEDE4E6B9BCAF1DA2DD398341D
4476	704E.tmp	C:\Users\admin\AppData\Local\Temp\70BB.tmp		executable
		MD5:0A351738AF77DB8503D1B9D6969BA422	SHA256:445EA3C49C636607EDCEEC04D0E83BA01BA0E35D468653A9E7C4281254DAD2BD
1964	6FE0.tmp	C:\Users\admin\AppData\Local\Temp\704E.tmp		executable
		MD5:FDCCCD172D58962CB792A227ED29FCC8	SHA256:B94373BD9ED7B8A9B91C647A89F7AFCA1DC5EA7F8D014C22B5D0997EEE80FDDF
2044	6E1B.tmp	C:\Users\admin\AppData\Local\Temp\6E79.tmp		executable
		MD5:2DFC2759CB37F5EF5F1DF244555057E9	SHA256:6BFDCEFA1BF5E0B3A13509CFFF8A44D0152D2C9DCD150CEA6BAE7A46E052B013
2076	2025-06-21_e8b0b3e87ffb775b93075db96c4c4c82_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\6E1B.tmp		executable
		MD5:E36FACBCA0E4432619A14AA747A8B11A	SHA256:93911F3D51417673C9E899693B1816F8669BE2600C48F6A6361D76C30E83B56C
6124	6F73.tmp	C:\Users\admin\AppData\Local\Temp\6FE0.tmp		executable
		MD5:131472216F68B377B17BB061F4652040	SHA256:0E98D6C53B10BAD2E25C103B35D3F86229706A80B8A0B7E6263381F23ECB91F7
5708	7271.tmp	C:\Users\admin\AppData\Local\Temp\72CE.tmp		executable
		MD5:1B75FF5797845CEAD55104B1424FD924	SHA256:0810B0EC89B53136203C9970772E523D043C183F0124A688D6C663AB88A72CF6
3832	7213.tmp	C:\Users\admin\AppData\Local\Temp\7271.tmp		executable
		MD5:3F940FFAA52926C24C05F06282FB2EFA	SHA256:7B4F1A8A7D8F921719EE16650054207E94F61E5EE4289D6553703A2A21E302DE

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
6700	RUXIMICS.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6700	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	40.126.32.76:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	200	40.126.32.76:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	16.7 Kb	whitelisted
—	—	POST	200	20.190.160.5:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted
—	—	POST	200	20.190.160.22:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6700	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
6700	RUXIMICS.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5944	MoUsoCoreWorker.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
6700	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 4.231.128.59 20.73.194.208	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.55.104.172 23.55.104.190 23.53.40.176 23.53.40.178	whitelisted
www.microsoft.com	95.101.149.131 23.35.229.160	whitelisted
login.live.com	20.190.160.17 40.126.32.138 20.190.160.130 20.190.160.5 40.126.32.140 40.126.32.74 20.190.160.14 20.190.160.67	whitelisted
client.wns.windows.com	172.211.123.248 172.211.123.249	whitelisted
nexusrules.officeapps.live.com	52.111.229.48	whitelisted
slscr.update.microsoft.com	172.202.163.200	whitelisted
fe3cr.delivery.mp.microsoft.com	13.85.23.206	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

General Info

2025-06-21_e8b0b3e87ffb775b93075db96c4c4c82_elex_mafia_stealc_tofsee

E8B0B3E87FFB775B93075DB96C4C4C82

06CD2EBD51F3666A576350666DF487177500600D

E3CEEE3A139CC120108E50F57AF99BEAA39E9576E06242DC6461D9C9FD9DE77F

24576:msYXjV7ICQIyIcOUM/BFKyqOKbDiUIV1yiyzSCvq5TJLCvY90D8/LVBlVk736Y7k:msYXjVECQIyIcOUM/BFKyqOKbDiBVUiH

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings