CmdID

CmdID / Files

msdtc.exe

Microsoft Distributed Transaction Coordinator Service file version info

Program on Windows 6 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real msdtc.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Distributed Transaction Coordinator Service

6 known copies

2001.12.10941.16384 (rs1_release.160715-1616) · C:\Windows\system32\msdtc.exe · signed by Microsoft Windows

72db45ca11fe635df9f8273c38cbefb8df5362ada0cbf6d2b1e570365dc700c0

2001.12.10941.16384 (WinBuild.160101.0800) · C:\Windows\system32\msdtc.exe · signed by Microsoft Windows

1eab4b9691e9efa1da02bdcb84035f65eda4b525e5aee925a6e1e4107f8e4f31

2001.12.10941.16384 (WinBuild.160101.0800) · C:\WINDOWS\system32\msdtc.exe · signed by Microsoft Windows

8ddc6d67a14b549946d103f2a5e7b1eb23c68bb6e7b8ecbc192365c7323ec458

2001.12.10941.16384 (WinBuild.160101.0800) · C:\WINDOWS\system32\msdtc.exe · signed by Microsoft Windows

9f454ad0c63c4a899a6d081de9a254a88dbb07fac538bcddf7ecd7f854b4360b

2001.12.10941.16384 (WinBuild.160101.0800) · C:\Windows\system32\msdtc.exe · signed by Microsoft Windows

edfe71025c352d0dabec7b9506c5945bb0ec11f8db540db8cb1116c2ea1648a8

2001.12.10530.16384 (winblue_rtm.130821-1623) · C:\windows\system32\msdtc.exe · not signed

8a335c28fe1ef96dd71485877f2e86155d24b5614ace05468f4b07e2acd56331

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name msdtc.exe
highLazarus System Binary MasqueradingTrent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)

Sigma names msdtc.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.