CmdID

CmdID / Files

nbtstat.exe

TCP/IP NetBios Information file version info

Program on Windows 6 known copies with hashes 2 Sigma rules name it Command nbtstat

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real nbtstat.exe?

file version info and known copies
Original namenbtinfo.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTCP/IP NetBios Information

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\nbtstat.exe · signed by Microsoft Windows

9109e2e1162357ed76121617163f7e0d50beb7bbba3aa785082317e90344c5f7

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\nbtstat.exe · signed by Microsoft Windows

6210fa6ade115dd07409cfae21683b1772d6d3fdb6b438814cacbd3588dad9e3

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\nbtstat.exe · signed by Microsoft Windows

40abbd7ebdb3cd6fa60e9af4a584e99d7295dd10d97feccfeaf5183f5a943c54

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\nbtstat.exe · signed by Microsoft Windows

28c46c4ee53050720e06c4bb0d1f64aef651438e3a712398d488426355a330c7

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\nbtstat.exe · signed by Microsoft Windows

41c05b8342add13aef5f2cf291c18cf4aff0db4d62539c4d48f35d1ab1db0570

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\nbtstat.exe · not signed

778cd1ebfdc9fa6457497741da5431e4de16f2fad490ed88ade6e3bec16096b1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name nbtstat.exe
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

Sigma names nbtstat.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.