CmdID

CmdID / Files

NETSTAT.EXE

TCP/IP Netstat Command file version info

Program on Windows 12 known copies with hashes 6 Sigma rules name it Command netstat

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real NETSTAT.EXE?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTCP/IP Netstat Command

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\NETSTAT.EXE · signed by Microsoft Windows

16a4e95654426697dd243bb9a46e9df985ce514112347fb9648ce0949485e8cc

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\NETSTAT.EXE · signed by Microsoft Windows

43ade842c3c8f5bc40bce70f3026274dcd06d4a20c0c1e52f14791f67780ef30

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\NETSTAT.EXE · signed by Microsoft Windows

5b0c639e4b9916d7ee58a75587cf5bb8d6136bdf2dec95537c1765720c7b7ccc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\NETSTAT.EXE · signed by Microsoft Windows

b094e827af70241d71bed9767ec1a254fdc4164a646b2ba4c7105cd783adba0d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\NETSTAT.EXE · signed by Microsoft Windows

5a780d6630639ffb7fd3d295c182eaa2a7cad2c70248c5ba8f334bb3803353ca

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\NETSTAT.EXE · signed by Microsoft Windows

cb589901a8d9dd0dc5abce999988bf143547ee5fc13093cba015c3bdd14bc37f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\NETSTAT.EXE · signed by Microsoft Windows

9372044b501fefae7333a59624379dbfc7e4eccbea965ee7058f2583709c2287

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\NETSTAT.EXE · signed by Microsoft Windows

aca66f4bc15e1b8ede8f05f59dfafb15fa47d9e89ea1d4cf59264ba3d483f47c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\NETSTAT.EXE · signed by Microsoft Windows

1f07b7c0c17324aeead6e7105a9668976d8731414448f56aacee49baa01351f6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\NETSTAT.EXE · signed by Microsoft Windows

9f070e1f4aa9ae0a5ea084febbd5983293e5748d0a5cc5d46098cb9271d2d508

6.3.9600.18202 (winblue_ltsb.160119-0600) · C:\windows\SysWOW64\NETSTAT.EXE · not signed

020d818a559a554ec18ab66779db4aa756caba7412f0454041a4923fbb34a1a9

6.3.9600.18202 (winblue_ltsb.160119-0600) · C:\windows\system32\NETSTAT.EXE · not signed

2faced0aba2a30b41dc2112f70a9b0c076c58ec2d25dfc5c7646c32b763c0954

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name NETSTAT.EXE
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highPotential Pikabot Discovery ActivityAndreas Braathen (mnemonic.io)
highPotential Process Injection Via Msra.EXEAlexander McDonald
highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga
highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson