CmdID

CmdID / Files

netdom.exe

NETDOM5 file version info

Program on Windows 6 known copies with hashes 1 Sigma rule names it Command netdom

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real netdom.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNETDOM5

6 known copies

10.0.17763.503 (WinBuild.160101.0800) · C:\Windows\SysWOW64\netdom.exe · signed by Microsoft Windows

1642e1d362a61cd9b943c6229019134e41489e8bfd2b04dd9b50e9ddd80051cd

10.0.17763.503 (WinBuild.160101.0800) · C:\Windows\system32\netdom.exe · signed by Microsoft Windows

f2caafc70211041e0d4ed16ef6d6478baf97d7c0c366dbfe24756d49f66fceac

10.0.14393.2969 (rs1_release.190503-1820) · C:\Windows\SysWOW64\netdom.exe · signed by Microsoft Windows

06c3760a5e0d3fb481d36c21da96c41ec950501bc53bc259e4965343c0bc600e

10.0.14393.2969 (rs1_release.190503-1820) · C:\Windows\system32\netdom.exe · signed by Microsoft Windows

556ff386189b7cdc39d6610acf4d15cbb9a406ef001644482a746ff745510e1e

6.3.9600.19343 (winblue_ltsb.190404-0600) · C:\windows\system32\netdom.exe · not signed

5c8b5b0cd12bd7f636cb8cc4093c8c59890a597a57b453d3c6f53840a82e5ed2

6.3.9600.19343 (winblue_ltsb.190404-0600) · C:\windows\SysWOW64\netdom.exe · not signed

67af5624b5e1fd7ffec6bc0c505ac248791b3aeb5566ff14dd73c938f4466581

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name netdom.exe
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)