CmdID

CmdID / Files

rdpinit.exe

RemoteApp Logon Application file version info

Program on Windows 14 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real rdpinit.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemoteApp Logon Application

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdpinit.exe · signed by Microsoft Windows

ef5eb8a177c1829a70c9cd95c7c04e6852fc03c6dbacf2451aa4172fecf8ea29

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpinit.exe · signed by Microsoft Windows

15d254d1862e3f4225361bc180d4cbc6db52d87487005f5e3d1366d73f891b3f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpinit.exe · signed by Microsoft Windows

1d32e669a4d9f07caa2fffde6122ab18454cda552ac138035511712a5d051244

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpinit.exe · signed by Microsoft Windows

51251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpinit.exe · signed by Microsoft Windows

a4bbe8274d83b75bfd6a2dee159a46c7221bb33e092677cdc2e1cb704eff7dde

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\rdpinit.exe · signed by Microsoft Windows

8fe58e1f1d073b15c7fcde5e40df100ac889344690cc95bc5f38486fc95cbebf

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpinit.exe · signed by Microsoft Windows

22014bb1e218fd88042a894ab46d0008d8e85c9cccf66c2b84cc123d432a7130

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rdpinit.exe · signed by Microsoft Windows

25c9f3eb6d251714b3f66be3e22ea71ba8a0a70659ecd7dfa1e21b27e2086723

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\rdpinit.exe · signed by Microsoft Windows

64621e06f11df3674e138ae3ca383844bd38057a938aabf6b9d076755678ac8b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\rdpinit.exe · signed by Microsoft Windows

f9a9873daa66b4b2d65b028cf17056de94c988708fae9260efa64ddecfaab1b4

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\rdpinit.exe · signed by Microsoft Windows

2fb0716aedf238bf91ee03a30513ea525def3adef41a61ff1c32bd8705c7e545

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\rdpinit.exe · signed by Microsoft Windows

4d1ae60c7c99430ce01fb048e9bca3e363de975d67cdd474fdc1eb305e1491f8

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\rdpinit.exe · not signed

85cf29dfdda3166b0c3d8adadecf00833fc6aa251b0f2c628bff2e698f87d8ec

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\rdpinit.exe · not signed

b04bfc32973c033462a3387cce4b5ede51afe5f50fa36900f097fd369a2470ee

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name rdpinit.exe
mediumPotential APT FIN7 Exploitation ActivityAlex Walston (@4ayymm)