File name:	2025-08-01_3257f1fb32acf961d2e3df7367e02e41_elex_mafia_stealc_tofsee.exe
Full analysis:	https://app.any.run/tasks/88be7b6b-75f7-474c-9546-43f97907930f
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 03:41:57
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	3257F1FB32ACF961D2E3DF7367E02E41
SHA1:	EF67B649A944C8C357E3EFE795103AEDB88F7240
SHA256:	F0639DCBA729F30EC0C620E8B875AA89D46BB0BF31F1370DF312DE3C4F4CF0D5
SSDEEP:	12288:wsYXHjErS5EWEc59eZCOa+ukJgCoVp5u8o8Lpr4/dA5VVh6yzD:wsYXjV7ICR+NJjoVpHaHyz

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
7080	D869.tmp	C:\Users\admin\AppData\Local\Temp\D8C7.tmp		executable
		MD5:855EC444CD1FF77E9CBABAD980F0DC88	SHA256:8A958D99E2BDC91ED210B3D363466DE679026AD821014C31BF99A694B758C447
1096	D9F0.tmp	C:\Users\admin\AppData\Local\Temp\DA4E.tmp		executable
		MD5:D8B9B18E2B9183B1BC3E9667A5F8EF07	SHA256:A561C9EBB084DE9EE6F01A1FFC8210A869956F599E8C515394D2BF7698EF2383
5496	DA4E.tmp	C:\Users\admin\AppData\Local\Temp\DAAB.tmp		executable
		MD5:032D42C3F1D7B2699053DE46B94B79F5	SHA256:A8DF27B80A357B541932FBEB4EB0FEA86AB7C9A65CCB5A06364DE86841A027D5
4844	DAAB.tmp	C:\Users\admin\AppData\Local\Temp\DB09.tmp		executable
		MD5:76826E05FDE8D9DC052C1797C19B9D18	SHA256:00ACBD3616FA5D23141C29A934E3CB4C86EF6D7786091F38E3E2818C3BD17DB6
5552	2025-08-01_3257f1fb32acf961d2e3df7367e02e41_elex_mafia_stealc_tofsee.exe	C:\Users\admin\AppData\Local\Temp\D7FC.tmp		executable
		MD5:B69738E922C9440FE5939A99ED372208	SHA256:E4B11D6BAC3916BF7E2059D09F4606BD5FA2835738EDB96E8F77D7BD155A3014
1604	D934.tmp	C:\Users\admin\AppData\Local\Temp\D992.tmp		executable
		MD5:BFE3993DEDB0D9330E95B35594D206B9	SHA256:E02AB706F11452FC6FF0B99CB1DF2FADA6F2C8E42327011F6F7A78BCFD02983E
2228	DBC5.tmp	C:\Users\admin\AppData\Local\Temp\DC22.tmp		executable
		MD5:CA59A4309DD8D30AADAC1B9D97F2CF62	SHA256:B99260639E7983DA604454713782DE7EADBD788D898E34BEE667DCFC6BEA1D84
2604	DB67.tmp	C:\Users\admin\AppData\Local\Temp\DBC5.tmp		executable
		MD5:9704669F11F9E44716B0369EA8A2895C	SHA256:63D5A6E8432C60AA6476D640B8938586BD76F9A1321BC18BB2F99DCEAA645265
6760	DD99.tmp	C:\Users\admin\AppData\Local\Temp\DDF7.tmp		executable
		MD5:668B799E911F69A7BD218C1B501F08F7	SHA256:205E18C99F19CF1574F9A43CF8E1D5722C0C03CA201545038B2CF336C1EF85BD
3504	DC22.tmp	C:\Users\admin\AppData\Local\Temp\DC80.tmp		executable
		MD5:74379C3A0521C4754D8F876585BA02F6	SHA256:6BE28BDE60BF950333F6042118AC16F94378880E5778D70A040FC3B3271F7D76

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.28:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
4944	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	NL	binary	814 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	NL	binary	814 b	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	NL	binary	814 b	whitelisted
—	—	POST	200	40.126.31.71:443	https://login.live.com/RST2.srf	US	xml	1.24 Kb	whitelisted
—	—	POST	400	40.126.31.71:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	40.126.31.67:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	40.126.31.67:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	20.190.159.68:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4944	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.216.77.28:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
4944	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 20.73.194.208 51.124.78.146	whitelisted
google.com	142.250.186.46	whitelisted
crl.microsoft.com	23.216.77.28 23.216.77.6 23.216.77.42	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
login.live.com	20.190.159.129 40.126.31.129 20.190.159.68 20.190.159.73 40.126.31.67 40.126.31.71 40.126.31.130 40.126.31.128	whitelisted
slscr.update.microsoft.com	20.165.94.63	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted
self.events.data.microsoft.com	51.116.253.170	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
x1.c.lencr.org	104.76.201.34	whitelisted

General Info

2025-08-01_3257f1fb32acf961d2e3df7367e02e41_elex_mafia_stealc_tofsee.exe

3257F1FB32ACF961D2E3DF7367E02E41

EF67B649A944C8C357E3EFE795103AEDB88F7240

F0639DCBA729F30EC0C620E8B875AA89D46BB0BF31F1370DF312DE3C4F4CF0D5

12288:wsYXHjErS5EWEc59eZCOa+ukJgCoVp5u8o8Lpr4/dA5VVh6yzD:wsYXjV7ICR+NJjoVpHaHyz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts application with an unusual extension

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts itself from another location

INFO

Reads the computer name

Checks supported languages

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings