File name:	2025-08-01_7d2deffeef36dc09645f867fba00cf9b_elex_mafia_stealc_tofsee.exe
Full analysis:	https://app.any.run/tasks/9abc9502-7454-4d24-9fff-bcfb0a0bad14
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 04:25:02
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	7D2DEFFEEF36DC09645F867FBA00CF9B
SHA1:	601063F54F356103E1246E71575033F0023D7AF0
SHA256:	EDCBA5579B37AC6E84E7E8CCD8F47E633B9C8005915CFDC25EB2F1F5F38C320E
SSDEEP:	24576:msYXjV7ICw4QCVq69IY7rklXi7cB8yeSyzSCvq5TJLCvY90D8/LVBlVk736Y79G5:msYXjVECw4QCVq6f/klXi7cB8yeSyzSl

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1999:10:03 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1156	2025-08-01_7d2deffeef36dc09645f867fba00cf9b_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\DADA.tmp		executable
		MD5:EE17F3FA166CCC6B968B9270D6F0B5FC	SHA256:4E1A4F0173262469452F37A1BC45AC0B44DE68BDD0D271AEAB6999884CB52DF4
6668	DC03.tmp	C:\Users\admin\AppData\Local\Temp\DC70.tmp		executable
		MD5:D08ADF135092AAD04A6308589A7938A9	SHA256:03B2CF358A216E1531CB65A177348D4C2DB69D816591A156065B2D471D0D9479
5284	DFAD.tmp	C:\Users\admin\AppData\Local\Temp\DFFB.tmp		executable
		MD5:3F312343CF216A198C8D0EF088F6FC8D	SHA256:A43F862322B0148F896FC7E82D8334BC1B930CE65148C1DA0E4CC7A85D798190
2848	DDF7.tmp	C:\Users\admin\AppData\Local\Temp\DE55.tmp		executable
		MD5:717821242035D933AA475C574A28737F	SHA256:0FDFC37FAE831ADBC891F645B56BEAE3E4109B9C1E25E448EA9F3A6194B5A40A
2148	DD3C.tmp	C:\Users\admin\AppData\Local\Temp\DD99.tmp		executable
		MD5:27040EAA44127343825ECEF8E716BAC0	SHA256:5A5B3ABFF5172A3B5F17112CAB6581C77CDE42CCFC74CE052FD5D7ADF57909DE
4880	DEC2.tmp	C:\Users\admin\AppData\Local\Temp\DF30.tmp		executable
		MD5:B142ED27594410E3EEE2BA5E086970C5	SHA256:094D85BDF6E85F21947EED561744B73E49D4C36F2CF8B606CEE0027FFE7D86F7
1932	DC70.tmp	C:\Users\admin\AppData\Local\Temp\DCDE.tmp		executable
		MD5:A32F21D628982ACE60834944AD465EBB	SHA256:0AB59339C80C256ED9F73C0B150F2BD93C9D7BE8C7C1D819734D8867F953835F
2168	DD99.tmp	C:\Users\admin\AppData\Local\Temp\DDF7.tmp		executable
		MD5:E12724503308E2C583F545C7F8F90EF4	SHA256:F5304C1DC9F98518A49025532770225FD7F4D5755AD234F0EDEA3FDBF1F41F88
5960	DF30.tmp	C:\Users\admin\AppData\Local\Temp\DFAD.tmp		executable
		MD5:D04BFD5E2628C2B536B3681F806BDB76	SHA256:7D39AF99ADAD244D9A3144AE25A23BF86BD25619E73EEB734955FF1A0ABA05A5
4460	DCDE.tmp	C:\Users\admin\AppData\Local\Temp\DD3C.tmp		executable
		MD5:FB11378A3030245E9DA5151FD41F0FAC	SHA256:417796125ECA88ECD0BFCBBF417D9754075E786E29DCE6EBC735FFCC4FD84B07

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.48.23.156:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.48.23.156:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5824	RUXIMICS.exe	GET	200	23.48.23.156:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5824	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	40.126.31.1:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	400	20.190.159.0:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	POST	400	40.126.31.0:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	POST	400	40.126.31.131:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5824	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.48.23.156:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.48.23.156:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5824	RUXIMICS.exe	23.48.23.156:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 51.124.78.146	whitelisted
google.com	142.250.185.206	whitelisted
crl.microsoft.com	23.48.23.156 23.48.23.143 2.16.241.14 2.16.241.12	whitelisted
www.microsoft.com	23.35.229.160 95.101.149.131	whitelisted
login.live.com	20.190.160.128 20.190.160.66 20.190.160.130 20.190.160.64 40.126.32.76 20.190.160.67 40.126.32.68 40.126.32.138	whitelisted
slscr.update.microsoft.com	52.149.20.212	whitelisted
fe3cr.delivery.mp.microsoft.com	40.69.42.241	whitelisted
self.events.data.microsoft.com	20.42.65.84	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
x1.c.lencr.org	72.246.169.163	whitelisted

General Info

2025-08-01_7d2deffeef36dc09645f867fba00cf9b_elex_mafia_stealc_tofsee.exe

7D2DEFFEEF36DC09645F867FBA00CF9B

601063F54F356103E1246E71575033F0023D7AF0

EDCBA5579B37AC6E84E7E8CCD8F47E633B9C8005915CFDC25EB2F1F5F38C320E

24576:msYXjV7ICw4QCVq69IY7rklXi7cB8yeSyzSCvq5TJLCvY90D8/LVBlVk736Y79G5:msYXjVECw4QCVq6f/klXi7cB8yeSyzSl

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts itself from another location

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Starts application with an unusual extension

Executable content was dropped or overwritten

The process executes via Task Scheduler

Application launched itself

INFO

Reads the computer name

Checks supported languages

Reads the machine GUID from the registry

Process checks whether UAC notifications are on

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings