CmdID

CmdID / Files

rasdial.exe

Remote Access Command Line Dial UI file version info

Program on Windows 14 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rasdial.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemote Access Command Line Dial UI

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rasdial.exe · signed by Microsoft Windows

a19399a741c02a775f58d83db883f0f064de998fc857e699c60177a820ca73dc

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rasdial.exe · signed by Microsoft Windows

ae8abd0dc927e9e75ab796ef251e6db5d19ebca37b8ca04ec11c6d5170a46609

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rasdial.exe · signed by Microsoft Windows

a33f829dd3fbba909fa13abb902fad29a12e1519f295db39fdd10a28094b9942

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rasdial.exe · signed by Microsoft Windows

31016ae60a8aef2dbf1c399f7709bc4ff69be1e2ebae5699fa55cfca606c397a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rasdial.exe · signed by Microsoft Windows

56572b71f9e7e3151fad06ee724a1cc11c6d56b27981ad2e6feef0a0d759f12c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rasdial.exe · signed by Microsoft Windows

a5d1f1c9a53f285d027cd1d57326fb323c4b90fbfef9b9806a46328a09b7bf08

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\rasdial.exe · signed by Microsoft Windows

54fce1edd9d726561970895668a0c8cc94542d591ee17d6d8a40ed5a531e3e0e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rasdial.exe · signed by Microsoft Windows

fbaf36c2fc8c597dacbdc7976c6c541d3e8ecf2d6e8c0b302e4a95a742824169

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rasdial.exe · signed by Microsoft Windows

7427fe46c5a8b9a8e2a85ffe4af8706473ce02ecd4168517c3ff81e6802302e1

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rasdial.exe · signed by Microsoft Windows

974a95d16a089b476ca8f931cd0d5cd59c8061b04cce8ffd423aab555a1dfbe3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rasdial.exe · signed by Microsoft Windows

6f52d81dbbb6d07c033299b9b64a0011b59089401327cdf494611649e392372e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rasdial.exe · signed by Microsoft Windows

c0075057e4404bc35396f87343675790e85713b362daaf4cbf72bf1387b1574c

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\rasdial.exe · not signed

71dc30513eb3dcb8c84aa1dbf8d2a985477ae7a3d12921edd2b7b1db8eae11fb

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rasdial.exe · not signed

f532d2031b53b90c1b851e4640c6f24dbfe9383a05cf0b3bdc0b580ebaadaf77

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name rasdial.exe
mediumSuspicious RASdial Activityjuju4