File name:

Reminder.exe

Full analysis: https://app.any.run/tasks/00dea2ad-696e-4405-9edc-9fe58b07083e
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: November 20, 2024, 10:14:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
rat
asyncrat
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

EB22ACF6CDECB8F70AA9FF7636819F51

SHA1:

F99D702FFAD21547F7CCE82CCBCAD0795C0F197F

SHA256:

5F2B53F1B119CC3E39C36C94E237E2CECDBEEB688ED0D2AE1365FB75A608C86F

SSDEEP:

98304:0rq3BdwBsfJBlycBHZ6BDPtvYZ6/vJsjSCPPuqV8sYITYethgUlqjvfhYvHgNbGQ:M96fq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • find.exe (PID: 2940)
      • cmd.exe (PID: 1296)
      • tasklist.exe (PID: 5544)
      • find.exe (PID: 5896)
      • tasklist.exe (PID: 4228)
      • cmd.exe (PID: 3732)
      • tasklist.exe (PID: 4340)
      • find.exe (PID: 5380)
      • cmd.exe (PID: 5104)
      • find.exe (PID: 372)
      • cmd.exe (PID: 1296)
      • tasklist.exe (PID: 5540)
      • cmd.exe (PID: 5780)
      • tasklist.exe (PID: 2096)
      • find.exe (PID: 5880)

    • Starts CMD.EXE for self-deleting

      • Updater.exe (PID: 236)

    • ASYNCRAT has been detected (SURICATA)

      • MSBuild.exe (PID: 2876)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Reminder.tmp (PID: 5104)

    • Executable content was dropped or overwritten

      • Reminder.tmp (PID: 5104)
      • Reminder.exe (PID: 5176)
      • Reminder.exe (PID: 2076)
      • Reminder.tmp (PID: 5872)
      • Updater.exe (PID: 5456)

    • Reads the Windows owner or organization settings

      • Reminder.tmp (PID: 5104)
      • Reminder.tmp (PID: 5872)

    • Starts CMD.EXE for commands execution

      • Reminder.tmp (PID: 5872)
      • Updater.exe (PID: 236)

    • Get information on the list of running processes

      • Reminder.tmp (PID: 5872)
      • cmd.exe (PID: 1296)
      • cmd.exe (PID: 5780)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 5104)
      • cmd.exe (PID: 1296)
      • cmd.exe (PID: 5780)

    • Starts the AutoIt3 executable file

      • Reminder.tmp (PID: 5872)
      • cmd.exe (PID: 3688)

    • Hides command output

      • cmd.exe (PID: 3688)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 3688)

    • The executable file from the user directory is run by the CMD process

      • Updater.exe (PID: 5456)

    • Contacting a server suspected of hosting an CnC

      • MSBuild.exe (PID: 2876)

    • Connects to unusual port

      • MSBuild.exe (PID: 2876)

  • INFO

    • Create files in a temporary directory

      • Reminder.exe (PID: 5176)
      • Reminder.tmp (PID: 5104)
      • Reminder.exe (PID: 2076)
      • Reminder.tmp (PID: 5872)

    • Checks supported languages

      • Reminder.exe (PID: 5176)
      • Reminder.tmp (PID: 5104)
      • Reminder.exe (PID: 2076)
      • Reminder.tmp (PID: 5872)

    • Reads the computer name

      • Reminder.tmp (PID: 5104)
      • Reminder.tmp (PID: 5872)

    • Process checks computer location settings

      • Reminder.tmp (PID: 5104)

    • The process uses the downloaded file

      • Reminder.tmp (PID: 5104)

    • Creates files or folders in the user directory

      • Reminder.tmp (PID: 5872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (49.7)
.odttf | Obfuscated subsetted Font (23.5)
.exe | Win32 EXE PECompact compressed (generic) (18.8)
.dll | Win32 Dynamic Link Library (generic) (2.9)
.exe | Win32 Executable (generic) (2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 149504
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 20.24.10.24
ProductVersionNumber: 20.24.10.24
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: OpenTTD Development Team
FileDescription: OpenTTD
FileVersion: 20.24.10.24
LegalCopyright: Copyright \xA9 OpenTTD Developers 2002-2024. All Rights Reserved.
OriginalFileName:
ProductName: OpenTTD
ProductVersion: 20.24.10.24
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
35
Malicious processes
6
Suspicious processes
5

Behavior graph

Click at the process to see the details
start reminder.exe reminder.tmp reminder.exe reminder.tmp cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs updater.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs updater.exe msbuild.exe no specs #ASYNCRAT msbuild.exe

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Users\admin\AppData\Local\OpenTTD\\Updater.exe" "C:\Users\admin\AppData\Local\OpenTTD\\gametophyte.csv"C:\Users\admin\AppData\Local\OpenTTD\Updater.exe—Reminder.tmp
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 1
Modules
Images
c:\users\admin\appdata\local\openttd\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
364\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
372find /I "avgui.exe"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1288\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1296"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe"C:\Windows\System32\cmd.exe—Reminder.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1296"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe"C:\Windows\System32\cmd.exe—Reminder.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2076"C:\Users\admin\AppData\Local\Temp\Reminder.exe" /VERYSILENTC:\Users\admin\AppData\Local\Temp\Reminder.exe
Reminder.tmp
User:
admin
Company:
OpenTTD Development Team
Integrity Level:
MEDIUM
Description:
OpenTTD
Exit code:
0
Version:
20.24.10.24
Modules
Images
c:\users\admin\appdata\local\temp\reminder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
2096tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
6 300
Read events
6 299
Write events
1
Delete events
0

Modification events

(PID) Process:(5456) Updater.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:fcacchd
Value:
"C:\hdaahcc\AutoIt3.exe" C:\hdaahcc\fcacchd.a3x
Executable files
15
Suspicious files
6
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
2076Reminder.exeC:\Users\admin\AppData\Local\Temp\is-TSTL3.tmp\Reminder.tmpexecutable
MD5:40D452E731106294020481A25BCBCBCF
SHA256:43A7A784865CB7C970BEFF227BC0D48BCD1C83E8ACA489E312D264612156304D
5872Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-NHI9V.tmp\is-N93J9.tmpexecutable
MD5:BA6DFB6F8E350F05B34E97098766A59F
SHA256:75263FC3534A3162B9E44E353B3C2379169787286DF7B65CB4ADC3D8BFBD533C
5104Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-6MJFK.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
5872Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-NHI9V.tmp\ddETWExternal.dllexecutable
MD5:BA6DFB6F8E350F05B34E97098766A59F
SHA256:75263FC3534A3162B9E44E353B3C2379169787286DF7B65CB4ADC3D8BFBD533C
5872Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-NHI9V.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
5104Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-6MJFK.tmp\_isetup\_isdecmp.dllexecutable
MD5:077CB4461A2767383B317EB0C50F5F13
SHA256:8287D0E287A66EE78537C8D1D98E426562B95C50F569B92CEA9CE36A9FA57E64
5872Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-NHI9V.tmp\_isetup\_isdecmp.dllexecutable
MD5:077CB4461A2767383B317EB0C50F5F13
SHA256:8287D0E287A66EE78537C8D1D98E426562B95C50F569B92CEA9CE36A9FA57E64
5872Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-NHI9V.tmp\NVFTVRDLL64.dllexecutable
MD5:A1632BF8A030FD810D2B716C39297CC5
SHA256:30C2F0FC9C37B8A4AF5FE5A946ECF204BDB10FBFB1728FDAB9B00104DAD5AEAC
5872Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-NHI9V.tmp\NvFrapsOpenVR.manxml
MD5:990CE7FAE6E9D4DA5B07DA99B8E5C918
SHA256:F52C4DCD61503F74EF1BC7F98CF8BB79963826CCCD35B0EFBFE5E3CAC8D75DD0
5872Reminder.tmpC:\Users\admin\AppData\Local\Temp\is-NHI9V.tmp\is-LQJ7J.tmptext
MD5:537A7DEEE8B9849D6C5A8552AFD2AAB0
SHA256:ADFEABFEAEB1376B3E0FABBFE0C3D76D8A62AFA38D016571357ACA37FF2DDEB6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
36
DNS requests
16
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5456
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5456
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4932
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4932
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
104.126.37.123:443
—
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.206
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.71
  • 20.190.159.23
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.68
  • 20.190.159.2
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted

Threats

PID
Process
Class
Message
2876
MSBuild.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
2876
MSBuild.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Reminder.exe