CmdID

CmdID / Files

quser.exe

Query User Utility file version info

Program on Windows 9 known copies with hashes 2 Sigma rules name it Command quser

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real quser.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionQuery User Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\quser.exe · signed by Microsoft Windows

9bd7dff0ddc49161228ab3babad37fc3793173c52b873680d77182e21585ab94

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\quser.exe · signed by Microsoft Windows

766c791edfa6eeeba0f99d6481bfe23bf59e6acb81a930b71f3aa33efbafe544

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\quser.exe · signed by Microsoft Windows

6ee15e5b1311d501fbdaa15c9d1197ba2f99745ea5abb3e724d598ee53d48a6e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\quser.exe · signed by Microsoft Windows

8a56b2b043ed340ffeec3845498005ebf972af3b937340f0fba064ea014ab1bb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\quser.exe · signed by Microsoft Windows

ccfaf494e520e4f265ad1de5252979809f1a28eb002f0e79c52981b00e63ac4f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\quser.exe · signed by Microsoft Windows

67d4ff2489b1c4e78928ca9ac9c1a79782a30bb976dc1ae49ac667cd5ac344a8

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\quser.exe · signed by Microsoft Windows

eae530a0d5cd045a90bbe6e12839aec0383486ccdaac07102d50250f381a2309

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\quser.exe · not signed

50557fd5ad11afb07926d1fc5e84de247183a0ebc184f5d02b142db126d90fb8

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\quser.exe · not signed

be42aa1ac3bfa70aa8c277a190743fbf1b942ba29ab149693aa86889ebe7ce04

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name quser.exe
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
lowLocal Accounts DiscoveryTimur Zinniatullin, Daniil Yugoslavskiy, oscd.community