IOC Report
tems.exe

loading gif

Files

File Path
Type
Category
Malicious
tems.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newfile.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\autA2F3.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autA352.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\isochronally
data
dropped
C:\Users\user\AppData\Local\Temp\unhelpable
ASCII text, with very long lines (29738), with no line terminators
dropped
C:\Users\user\AppData\Roaming\newfile\newfile.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\tems.exe
"C:\Users\user\Desktop\tems.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\tems.exe"
 malicious
C:\Users\user\AppData\Roaming\newfile\newfile.exe
"C:\Users\user\AppData\Roaming\newfile\newfile.exe"
malicious
C:\Users\user\AppData\Roaming\newfile\newfile.exe
"C:\Users\user\AppData\Roaming\newfile\newfile.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://mail.cash4cars.nz
unknown
http://ip-api.com/line/?fields=hostinggv
unknown
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
mail.cash4cars.nz
114.142.162.17
 malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
114.142.162.17
mail.cash4cars.nz
Australia
malicious
208.95.112.1
ip-api.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
newfile
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
28C1000
trusted library allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
1690000
direct allocation
page read and write
 malicious
28EC000
trusted library allocation
page read and write
 malicious
4F53000
heap
page read and write
89C000
stack
page read and write
DC0000
trusted library allocation
page read and write
715000
heap
page read and write
4B5E000
stack
page read and write
5BC0000
heap
page read and write
38B9000
trusted library allocation
page read and write
4D91000
trusted library allocation
page read and write
3F40000
direct allocation
page read and write
3BA1000
trusted library allocation
page read and write
6140000
trusted library allocation
page read and write
4209000
direct allocation
page read and write
1680000
direct allocation
page execute and read and write
FFF000
stack
page read and write
4F40000
heap
page read and write
80B000
heap
page read and write
1120000
trusted library allocation
page read and write
15DB000
stack
page read and write
CB1000
heap
page read and write
5BE9000
heap
page read and write
34E1000
trusted library allocation
page read and write
6F0000
trusted library allocation
page read and write
4F50000
heap
page read and write
420D000
direct allocation
page read and write
400000
system
page execute and read and write
1772000
heap
page read and write
15CE000
stack
page read and write
E36000
heap
page read and write
2891000
trusted library allocation
page read and write
3F40000
direct allocation
page read and write
243E000
stack
page read and write
4063000
direct allocation
page read and write
28FE000
trusted library allocation
page read and write
6260000
trusted library allocation
page read and write
C6E000
heap
page read and write
2A90000
heap
page execute and read and write
1717000
heap
page read and write
4E20000
heap
page read and write
420D000
direct allocation
page read and write
72D000
trusted library allocation
page execute and read and write
1778000
heap
page read and write
1743000
heap
page read and write
DC3000
unkown
page write copy
4B9E000
stack
page read and write
1743000
heap
page read and write
1772000
heap
page read and write
D8F000
unkown
page readonly
2EC000
stack
page read and write
747000
trusted library allocation
page execute and read and write
CF0000
heap
page read and write
51FE000
stack
page read and write
4209000
direct allocation
page read and write
118E000
stack
page read and write
52DE000
stack
page read and write
DBF000
unkown
page write copy
4A1F000
stack
page read and write
6020000
trusted library allocation
page read and write
4D7E000
trusted library allocation
page read and write
C50000
heap
page read and write
D01000
unkown
page execute read
2850000
trusted library allocation
page read and write
E24000
heap
page read and write
C7A000
heap
page read and write
15FC000
stack
page read and write
174D000
heap
page read and write
FE0000
heap
page read and write
16F0000
heap
page read and write
69E000
stack
page read and write
4A2D000
stack
page read and write
112B000
trusted library allocation
page execute and read and write
174D000
heap
page read and write
54BE000
stack
page read and write
CF0000
heap
page read and write
40E0000
direct allocation
page read and write
6007000
trusted library allocation
page read and write
17D1000
heap
page read and write
1772000
heap
page read and write
3F40000
direct allocation
page read and write
B80000
trusted library allocation
page execute and read and write
7B0000
trusted library allocation
page execute and read and write
427E000
direct allocation
page read and write
505C000
stack
page read and write
D01000
unkown
page execute read
174D000
heap
page read and write
D8D000
trusted library allocation
page execute and read and write
174D000
heap
page read and write
DAB000
trusted library allocation
page execute and read and write
26EE000
stack
page read and write
29FE000
trusted library allocation
page read and write
609D000
stack
page read and write
620F000
stack
page read and write
D70000
trusted library allocation
page read and write
1723000
heap
page read and write
E00000
heap
page read and write
4D96000
trusted library allocation
page read and write
5010000
trusted library allocation
page execute and read and write
4063000
direct allocation
page read and write
F00000
heap
page read and write
849000
heap
page read and write
1786000
heap
page read and write
1733000
heap
page read and write
DD0000
trusted library allocation
page read and write
4D8E000
trusted library allocation
page read and write
CAF000
heap
page read and write
24E1000
trusted library allocation
page read and write
247C000
stack
page read and write
4063000
direct allocation
page read and write
4209000
direct allocation
page read and write
420D000
direct allocation
page read and write
DA0000
heap
page read and write
83A000
stack
page read and write
1772000
heap
page read and write
4DFC000
stack
page read and write
252000
unkown
page readonly
9A0000
heap
page read and write
1772000
heap
page read and write
D7D000
trusted library allocation
page execute and read and write
24D0000
heap
page execute and read and write
AAF000
stack
page read and write
CAD000
heap
page read and write
C00000
heap
page read and write
17C1000
heap
page read and write
1717000
heap
page read and write
1104000
trusted library allocation
page read and write
D2A000
heap
page read and write
4209000
direct allocation
page read and write
6000000
trusted library allocation
page read and write
420D000
direct allocation
page read and write
427E000
direct allocation
page read and write
40E0000
direct allocation
page read and write
6A0000
heap
page read and write
603D000
trusted library allocation
page read and write
22EF000
stack
page read and write
D92000
trusted library allocation
page read and write
7C0000
heap
page read and write
4DA2000
trusted library allocation
page read and write
B60000
trusted library allocation
page read and write
2870000
trusted library allocation
page read and write
2BA1000
trusted library allocation
page read and write
1778000
heap
page read and write
C85000
heap
page read and write
AE5000
heap
page read and write
D8F000
unkown
page readonly
D00000
unkown
page readonly
40E0000
direct allocation
page read and write
4D8A000
trusted library allocation
page read and write
4D0E000
stack
page read and write
4C9E000
stack
page read and write
1789000
heap
page read and write
531E000
stack
page read and write
174E000
heap
page read and write
4063000
direct allocation
page read and write
710000
heap
page read and write
D9A000
trusted library allocation
page execute and read and write
DED000
trusted library allocation
page execute and read and write
4D82000
trusted library allocation
page read and write
3F40000
direct allocation
page read and write
AD0000
heap
page read and write
AE0000
heap
page read and write
4209000
direct allocation
page read and write
D00000
unkown
page readonly
45DE000
stack
page read and write
E06000
heap
page read and write
4D70000
trusted library allocation
page read and write
27EF000
stack
page read and write
4D7B000
trusted library allocation
page read and write
1100000
trusted library allocation
page read and write
7E0000
heap
page read and write
52FF000
stack
page read and write
DB5000
unkown
page readonly
6170000
trusted library allocation
page execute and read and write
40E0000
direct allocation
page read and write
4C00000
heap
page execute and read and write
1EEE000
stack
page read and write
2880000
heap
page read and write
C88000
heap
page read and write
427E000
direct allocation
page read and write
17D1000
heap
page read and write
D90000
trusted library allocation
page read and write
6D0000
heap
page read and write
DC8000
unkown
page readonly
5C32000
heap
page read and write
AC0000
heap
page read and write
6250000
heap
page read and write
40E0000
direct allocation
page read and write
16F8000
heap
page read and write
CBB000
heap
page read and write
D73000
trusted library allocation
page execute and read and write
99A000
stack
page read and write
D1E000
stack
page read and write
B50000
heap
page read and write
3F40000
direct allocation
page read and write
1140000
trusted library allocation
page read and write
17D1000
heap
page read and write
D55000
heap
page read and write
DA2000
trusted library allocation
page read and write
804000
heap
page read and write
509E000
stack
page read and write
DB5000
unkown
page readonly
1772000
heap
page read and write
298C000
stack
page read and write
519F000
stack
page read and write
54FE000
stack
page read and write
427E000
direct allocation
page read and write
4E10000
heap
page execute and read and write
1772000
heap
page read and write
4063000
direct allocation
page read and write
2450000
heap
page read and write
541E000
stack
page read and write
70D000
trusted library allocation
page execute and read and write
7F150000
trusted library allocation
page execute and read and write
17B8000
heap
page read and write
6050000
trusted library allocation
page execute and read and write
5500000
trusted library allocation
page read and write
1772000
heap
page read and write
28F4000
trusted library allocation
page read and write
17C1000
heap
page read and write
2830000
trusted library allocation
page read and write
66F0000
trusted library allocation
page execute and read and write
1724000
heap
page read and write
4209000
direct allocation
page read and write
D60000
trusted library allocation
page read and write
939000
stack
page read and write
6023000
trusted library allocation
page read and write
4898000
trusted library allocation
page read and write
7AE000
stack
page read and write
1722000
heap
page read and write
74B000
trusted library allocation
page execute and read and write
6770000
heap
page read and write
1748000
heap
page read and write
29A0000
trusted library allocation
page read and write
1732000
heap
page read and write
1732000
heap
page read and write
533E000
stack
page read and write
1778000
heap
page read and write
FD0000
heap
page read and write
DA5000
trusted library allocation
page execute and read and write
2840000
trusted library allocation
page read and write
25A000
unkown
page readonly
E52000
heap
page read and write
420D000
direct allocation
page read and write
40E0000
direct allocation
page read and write
174D000
heap
page read and write
D80000
trusted library allocation
page read and write
724000
trusted library allocation
page read and write
5FFE000
stack
page read and write
17C8000
heap
page read and write
E66000
heap
page read and write
1772000
heap
page read and write
17A2000
heap
page read and write
B70000
trusted library allocation
page read and write
174D000
heap
page read and write
DBF000
unkown
page read and write
282C000
stack
page read and write
DF0000
heap
page read and write
50BE000
stack
page read and write
4B1E000
stack
page read and write
10FF000
stack
page read and write
2860000
heap
page execute and read and write
650000
heap
page read and write
51DE000
stack
page read and write
427E000
direct allocation
page read and write
6010000
trusted library allocation
page read and write
1733000
heap
page read and write
5EFF000
stack
page read and write
5C1C000
heap
page read and write
543F000
stack
page read and write
5000000
heap
page execute and read and write
6033000
trusted library allocation
page read and write
4F0E000
stack
page read and write
28EA000
trusted library allocation
page read and write
4D76000
trusted library allocation
page read and write
51BE000
stack
page read and write
DF0000
trusted library allocation
page execute and read and write
D96000
trusted library allocation
page execute and read and write
1190000
trusted library allocation
page execute and read and write
2990000
trusted library allocation
page read and write
703000
trusted library allocation
page execute and read and write
C58000
heap
page read and write
24BE000
stack
page read and write
E2A000
heap
page read and write
427E000
direct allocation
page read and write
17A8000
heap
page read and write
D50000
heap
page read and write
DE3000
trusted library allocation
page execute and read and write
4E0E000
stack
page read and write
29B0000
heap
page read and write
C79000
stack
page read and write
704000
trusted library allocation
page read and write
E1F000
heap
page read and write
84B000
heap
page read and write
11A0000
heap
page read and write
817000
heap
page read and write
D36000
heap
page read and write
D20000
heap
page read and write
1713000
heap
page read and write
15BF000
stack
page read and write
720000
trusted library allocation
page read and write
CE0000
heap
page read and write
3891000
trusted library allocation
page read and write
174D000
heap
page read and write
1743000
heap
page read and write
1772000
heap
page read and write
250000
unkown
page readonly
FD4000
heap
page read and write
1778000
heap
page read and write
1723000
heap
page read and write
3E9000
stack
page read and write
1723000
heap
page read and write
B90000
heap
page read and write
4D9D000
trusted library allocation
page read and write
E00000
heap
page read and write
4063000
direct allocation
page read and write
1127000
trusted library allocation
page execute and read and write
D32000
heap
page read and write
174D000
heap
page read and write
3F40000
direct allocation
page read and write
420D000
direct allocation
page read and write
D9E000
stack
page read and write
DC8000
unkown
page readonly
DE4000
trusted library allocation
page read and write
6040000
trusted library allocation
page read and write
110D000
trusted library allocation
page execute and read and write
F4E000
stack
page read and write
E08000
heap
page read and write
D74000
trusted library allocation
page read and write
DA7000
trusted library allocation
page execute and read and write
38FC000
trusted library allocation
page read and write
E78000
heap
page read and write
F8E000
stack
page read and write
2B9E000
stack
page read and write
1735000
heap
page read and write
7E8000
heap
page read and write
DD0000
heap
page read and write
There are 328 hidden memdumps, click here to show them.