| File name: | restminder.exe |
| Full analysis: | https://app.any.run/tasks/99c0d0e8-0fc8-4dbf-9141-ae5d6a135cfd |
| Verdict: | Malicious activity |
| Analysis date: | February 28, 2024, 19:18:55 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 4E98A80BF5ACEA96708C203FE165CD47 |
| SHA1: | 0CF03F5000CAE7EF09B8E5AF3E8AB2F7EB73D9CE |
| SHA256: | BFCBB8781693D0D9E7DBE2BFA633A7CEA8BC8F7ACB1C1866830717B49AB826D2 |
| SSDEEP: | 98304:I+cD4dnoBJlKmIIm3/QQI5TZ2mMjyi10wd6ioRp1698uFbNKcWTz/dzq1mQBxE7O:SszqcNXKQ/ |
MALICIOUS
Drops the executable file immediately after the start
- restminder.exe (PID: 4052)
- restminder.tmp (PID: 1432)
Changes the autorun value in the registry
- RestMinder.exe (PID: 2848)
SUSPICIOUS
Reads settings of System Certificates
- restminder.tmp (PID: 1432)
- RestMinder.exe (PID: 2848)
Reads the Windows owner or organization settings
- restminder.tmp (PID: 1432)
Executable content was dropped or overwritten
- restminder.exe (PID: 4052)
- restminder.tmp (PID: 1432)
Reads the Internet Settings
- restminder.tmp (PID: 1432)
- RestMinder.exe (PID: 2848)
Process drops legitimate windows executable
- restminder.tmp (PID: 1432)
Reads security settings of Internet Explorer
- RestMinder.exe (PID: 2848)
Checks Windows Trust Settings
- RestMinder.exe (PID: 2848)
Reads Internet Explorer settings
- RestMinder.exe (PID: 2848)
Reads Microsoft Outlook installation path
- RestMinder.exe (PID: 2848)
INFO
Reads the computer name
- restminder.tmp (PID: 1432)
- RestMinder.exe (PID: 2848)
- wmpnscfg.exe (PID: 1740)
Create files in a temporary directory
- restminder.exe (PID: 4052)
- restminder.tmp (PID: 1432)
Checks supported languages
- restminder.exe (PID: 4052)
- restminder.tmp (PID: 1432)
- RestMinder.exe (PID: 2848)
- wmpnscfg.exe (PID: 1740)
Reads the machine GUID from the registry
- restminder.tmp (PID: 1432)
- RestMinder.exe (PID: 2848)
Reads the software policy settings
- restminder.tmp (PID: 1432)
- RestMinder.exe (PID: 2848)
Reads Environment values
- RestMinder.exe (PID: 2848)
Creates files or folders in the user directory
- RestMinder.exe (PID: 2848)
- restminder.tmp (PID: 1432)
Creates a software uninstall entry
- restminder.tmp (PID: 1432)
Checks proxy server information
- RestMinder.exe (PID: 2848)
Manual execution by a user
- wmpnscfg.exe (PID: 1740)
Reads the time zone
- RestMinder.exe (PID: 2848)
Reads product name
- RestMinder.exe (PID: 2848)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:04:14 16:10:23+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741888 |
| InitializedDataSize: | 318976 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.4.0 |
| ProductVersionNumber: | 1.0.4.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | RestMinder |
| FileDescription: | RestMinder Setup |
| FileVersion: | 1.0.4.0 |
| LegalCopyright: | Copyright © 2023 RestMinder |
| OriginalFileName: | |
| ProductName: | RestMinder |
| ProductVersion: | 1.0.4.0 |
Total processes
41
Monitored processes
4
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1432 | "C:\Users\admin\AppData\Local\Temp\is-SGPJ9.tmp\restminder.tmp" /SL5="$E0170,3500493,1061888,C:\Users\admin\Desktop\restminder.exe" | C:\Users\admin\AppData\Local\Temp\is-SGPJ9.tmp\restminder.tmp | restminder.exe | ||||||||||||
User: admin Company: RestMinder Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 1740 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2848 | "C:\Users\admin\AppData\Local\Programs\RestMinder\RestMinder.exe" | C:\Users\admin\AppData\Local\Programs\RestMinder\RestMinder.exe | restminder.tmp | ||||||||||||
User: admin Integrity Level: MEDIUM Description: RestMinder Exit code: 0 Version: 1.0.4.0 Modules
| |||||||||||||||
| 4052 | "C:\Users\admin\Desktop\restminder.exe" | C:\Users\admin\Desktop\restminder.exe | explorer.exe | ||||||||||||
User: admin Company: RestMinder Integrity Level: MEDIUM Description: RestMinder Setup Exit code: 0 Version: 1.0.4.0 Modules
| |||||||||||||||
Total events
12 392
Read events
12 308
Write events
78
Delete events
6
Modification events
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 98050000F04AEAFF7A6ADA01 | |||
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: 0601E960AF96DE5DB24CADC28E0F90CEBFEA481627DF283CBC853528C8144D7E | |||
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFiles0000 |
Value: C:\Users\admin\AppData\Local\Programs\RestMinder\RestMinder.exe | |||
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFilesHash |
Value: 8F9FBDE431548C518542029D9EE298C7B5A63BFF697A83B6353B6FC4FBA14DC7 | |||
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CURRENT_USER\Software\BreakJob |
| Operation: | write | Name: | version |
Value: 1.0.4.0 | |||
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F481E04A-B87F-46D3-8FC5-A3440DE071C9}_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 6.2.1 | |||
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F481E04A-B87F-46D3-8FC5-A3440DE071C9}_is1 |
| Operation: | write | Name: | Inno Setup: App Path |
Value: C:\Users\admin\AppData\Local\Programs\RestMinder | |||
| (PID) Process: | (1432) restminder.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F481E04A-B87F-46D3-8FC5-A3440DE071C9}_is1 |
| Operation: | write | Name: | InstallLocation |
Value: C:\Users\admin\AppData\Local\Programs\RestMinder\ | |||
Executable files
19
Suspicious files
5
Text files
5
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1432 | restminder.tmp | C:\Users\admin\AppData\Local\Temp\CabFC61.tmp | compressed | |
MD5:753DF6889FD7410A2E9FE333DA83A429 | SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78 | |||
| 1432 | restminder.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:753DF6889FD7410A2E9FE333DA83A429 | SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78 | |||
| 1432 | restminder.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:BC369400C11B2F5B4A84606D5312B457 | SHA256:C7F87433843360841D9E15B3F9E23757F3692A37C69F0BB05301BCC0032FC586 | |||
| 1432 | restminder.tmp | C:\Users\admin\AppData\Local\Programs\RestMinder\is-C2FFN.tmp | executable | |
MD5:6D70370C8E60CA754E58D1B7C33B46F8 | SHA256:C116836282C86049D4AAB6DF785179A5344C0B43870A86CFEB3AF842C6B3145A | |||
| 1432 | restminder.tmp | C:\Users\admin\AppData\Local\Programs\RestMinder\is-60S2B.tmp | xml | |
MD5:3E8F51C2B6FD8149C32819EADEC0CA72 | SHA256:0E7ACBB755E5161D596D65BC357EC09EE0F82017D15F65504E4EEC47DAC927BD | |||
| 1432 | restminder.tmp | C:\Users\admin\AppData\Local\Programs\RestMinder\RestMinder.exe.config | xml | |
MD5:3E8F51C2B6FD8149C32819EADEC0CA72 | SHA256:0E7ACBB755E5161D596D65BC357EC09EE0F82017D15F65504E4EEC47DAC927BD | |||
| 1432 | restminder.tmp | C:\Users\admin\AppData\Local\Programs\RestMinder\is-CQCV8.tmp | executable | |
MD5:2782BE9C7AC1CAD2B462DE90FB8D4129 | SHA256:EB69DEB0BD21A028D35EF1DEC4947FD560D85BF001D7284DD61D229B7226B11D | |||
| 1432 | restminder.tmp | C:\Users\admin\AppData\Local\Programs\RestMinder\RestMinder.exe | executable | |
MD5:2C17E3D1B350E9C7D92092C9B232D121 | SHA256:0B5DECBF3CC3BA7D1C805F6FD9BDC88010A8C551890E19D221162C6D35D2BB8A | |||
| 1432 | restminder.tmp | C:\Users\admin\AppData\Local\Programs\RestMinder\AsyncBridge.Net35.dll | executable | |
MD5:35CBDBE6987B9951D3467DDA2F318F3C | SHA256:E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83 | |||
| 1432 | restminder.tmp | C:\Users\admin\AppData\Local\Programs\RestMinder\is-DMHMK.tmp | executable | |
MD5:35CBDBE6987B9951D3467DDA2F318F3C | SHA256:E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
30
DNS requests
24
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1432 | restminder.tmp | GET | 200 | 23.48.23.34:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?96f8517ee450df11 | unknown | compressed | 67.5 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1432 | restminder.tmp | 104.21.51.143:443 | stats.restminder.com | CLOUDFLARENET | — | unknown |
1432 | restminder.tmp | 23.48.23.34:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
1432 | restminder.tmp | 172.67.181.104:443 | stats.restminder.com | CLOUDFLARENET | US | unknown |
2848 | RestMinder.exe | 116.202.83.219:5001 | equickping.com | — | — | unknown |
2848 | RestMinder.exe | 88.198.64.23:5001 | correspongfast.org | — | — | unknown |
2848 | RestMinder.exe | 104.21.51.143:443 | stats.restminder.com | CLOUDFLARENET | — | unknown |
2848 | RestMinder.exe | 104.16.124.96:443 | www.cloudflare.com | CLOUDFLARENET | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
stats.restminder.com |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
track.restminder.com |
| unknown |
equickping.com |
| unknown |
correspongfast.org |
| unknown |
www.cloudflare.com |
| whitelisted |
speed.cloudflare.com |
| unknown |
www.dhl.de |
| whitelisted |
www.google.com.au |
| whitelisted |
www.valueresearchonline.com |
| unknown |