File name:	2025-08-01_54ef74909c2e8c9a1dfbc42489ddcad0_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/c0b34518-efe7-48b2-92b7-cd6f5be6a7e3
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 02:05:18
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	54EF74909C2E8C9A1DFBC42489DDCAD0
SHA1:	637CE220BE441C14A00D9A4BDB7573AEE044E71B
SHA256:	FEC407978B93B7D66169BA677B7FE2CF0BA90659C32A52C84343F6875474F753
SSDEEP:	24576:cbY7DncCuOLg1XSLQ9xfQr4iWWt9usHlUmyzY:cbY7DncCuOLg1XSLQzfQr4iWWt9usFU4

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1668	D963.tmp	C:\Users\admin\AppData\Local\Temp\D9D1.tmp		executable
		MD5:3A857C1C66052A91B5C9C9CDB8C1C2DE	SHA256:955E616D41F566259A2EAD2D1425596A5436D8305459C030CA62CD80761E2C63
5764	D905.tmp	C:\Users\admin\AppData\Local\Temp\D963.tmp		executable
		MD5:CBCE89B6DA8B263B0A2D472B4C859FC7	SHA256:77EAE1ACF414C0D2D6F077DE14D9D59D5D8D84EBE7039B4297540665B91C07A9
5504	DA2E.tmp	C:\Users\admin\AppData\Local\Temp\DA9C.tmp		executable
		MD5:E82DEF7C7D5D2709DA7612D47C1D2FE3	SHA256:1DE505B81F4AE2012CE30B233B544D6F847C595A89C0FF3AB0199EE3E452E6F1
2596	DC22.tmp	C:\Users\admin\AppData\Local\Temp\DC80.tmp		executable
		MD5:781041ABAD6605EA50A300E542E34CBB	SHA256:28E520FB516A682A45D0DE07F5009527025F41C38726235ED4FC5E0C7C8E0E5B
3288	DA9C.tmp	C:\Users\admin\AppData\Local\Temp\DB09.tmp		executable
		MD5:F12EDFD42228A3932E4BABBFD0FFE731	SHA256:AD3FE3DBCF7EAED014DD75256A8E5442E6532F879D824F827138C702E32A1AB8
1612	DF10.tmp	C:\Users\admin\AppData\Local\Temp\DF7E.tmp		executable
		MD5:20246AB9EEF930068CA9A5062B5D3436	SHA256:4516A540EE41241E61023FED6F9DC0CFFA9952FFFD9144B5DCA8A84A024762AF
2492	2025-08-01_54ef74909c2e8c9a1dfbc42489ddcad0_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\D905.tmp		executable
		MD5:1BF6BEF949A8D4326DC8B292EC8F01D3	SHA256:78D57D24F032CBB81908CB89515E90A36CD24795ABF40443AEC2CC116E55B999
7040	DE26.tmp	C:\Users\admin\AppData\Local\Temp\DE93.tmp		executable
		MD5:DBD99656B58842172FBC3F0578444132	SHA256:52BE6576C7BB5A2D3573BF44DC5480D50A6ECE0F7F2C5509DF93F41703B80068
3572	DDA9.tmp	C:\Users\admin\AppData\Local\Temp\DE26.tmp		executable
		MD5:A55CE100B1414DB1D2AE31467F1050C8	SHA256:9EA2C12A9E052339978C850A6830B9C40EA7465C681806E0169EFD46CA75E3E6
1160	DF7E.tmp	C:\Users\admin\AppData\Local\Temp\DFDB.tmp		executable
		MD5:1F7794D7115E1E11E007FDC3CF3FCF3B	SHA256:C1A749FFF718BBFD6CAA7DEE40FD7E899167002488A9C479C967FDEC56663B0A

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.160.14:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
1268	svchost.exe	GET	200	23.216.77.42:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5288	RUXIMICS.exe	GET	200	23.216.77.42:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	POST	400	40.126.32.72:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
5288	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	400	40.126.32.76:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	400	40.126.32.76:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	POST	400	40.126.32.140:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5288	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.216.77.42:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.42:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5288	RUXIMICS.exe	23.216.77.42:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208 40.127.240.158 51.124.78.146 20.49.150.241	whitelisted
google.com	142.250.185.78	whitelisted
crl.microsoft.com	23.216.77.42 23.216.77.28 23.216.77.6	whitelisted
www.microsoft.com	23.35.229.160 23.3.109.244	whitelisted
login.live.com	20.190.159.2 20.190.159.75 20.190.159.0 20.190.159.128 40.126.31.128 40.126.31.3 40.126.31.0 20.190.159.130	whitelisted
slscr.update.microsoft.com	74.178.240.61	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted
self.events.data.microsoft.com	104.208.16.88	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224 20.83.72.98	whitelisted
x1.c.lencr.org	23.192.153.142	whitelisted

General Info

2025-08-01_54ef74909c2e8c9a1dfbc42489ddcad0_elex_mafia.exe

54EF74909C2E8C9A1DFBC42489DDCAD0

637CE220BE441C14A00D9A4BDB7573AEE044E71B

FEC407978B93B7D66169BA677B7FE2CF0BA90659C32A52C84343F6875474F753

24576:cbY7DncCuOLg1XSLQ9xfQr4iWWt9usHlUmyzY:cbY7DncCuOLg1XSLQzfQr4iWWt9usFU4

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Starts itself from another location

Starts application with an unusual extension

Executable content was dropped or overwritten

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings