CmdID

CmdID / Files

Robocopy.exe

Microsoft Robocopy file version info

Program on Windows 16 known copies with hashes 5 Sigma rules name it Command robocopy

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Robocopy.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Robocopy

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Robocopy.exe · signed by Microsoft Windows

b88a1b4d45ed2af1f40d708e4a6aa09da0f560c76256bef7cca9bd1898776a0e

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Robocopy.exe · signed by Microsoft Windows

ef0271d645f7849408fdc55c721a0c6cbd7717bdc2fa2a1e9cdb2082cd5eae59

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Robocopy.exe · signed by Microsoft Windows

f879c52c110afaa8e67a4b2c180cbfb48bcf52fa0dbeac0d26b1474e897679ad

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Robocopy.exe · signed by Microsoft Windows

ab5fe50644fd7e989c00f6596ec40284ff37a3ad8e44fbca98dbfbf9b5192a2e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Robocopy.exe · signed by Microsoft Windows

d7a46fc5af4dc3978f395dd601619111899d206c22aabdac77c10efe6a8425a9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\Robocopy.exe · signed by Microsoft Windows

f53934033106bd160d6e9c7bec2b1791fb4e1c6ddfc55d3342080d3004a87635

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\Robocopy.exe · signed by Microsoft Windows

34ef7ddc25ad476fe1afc29fa6a961dcdfcb1cc3bf1fbb14162d16aafe3b21d2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\Robocopy.exe · signed by Microsoft Windows

e78510c9eaba67be68e56e79e8977adcddd211ba9540f66d2e34c801fdc57b24

10.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Robocopy.exe · signed by Microsoft Windows

5d5ada9608945b0f18005a0ec867d1a6690a2d57ddcf9534f4519bdb402538b5

10.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\system32\Robocopy.exe · signed by Microsoft Windows

8a8f7c4c97b3e03a472ab99e0d22727435ae4350981056a63624f7c913417803

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Robocopy.exe · signed by Microsoft Windows

90473e53abebd3175a5747e06a33ba497987c208947fd0b71fe0bda1fccc8d99

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\Robocopy.exe · signed by Microsoft Windows

b5a99113cc15c20ec50f2e2042a06c7760ee79504c559d8368334923f6be1eb7

10.0.14393.2636 (rs1_release_1.181031-1836) · C:\Windows\SysWOW64\Robocopy.exe · signed by Microsoft Windows

9b249c54707b822d797c974743458dee9ee7f335ed12ec18bccc978cd16debb7

10.0.14393.2636 (rs1_release_1.181031-1836) · C:\Windows\system32\Robocopy.exe · signed by Microsoft Windows

cd428783f988cfc30e2f70b555c651e80dd7522e2dd19b663ec41cb8c4d9b167

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\Robocopy.exe · not signed

7cff03f890334150ce3f369c395781e0809911623543150b418357724d2cc459

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Robocopy.exe · not signed

af762961e3d47c8e378e1b5127e3a3f1000d5382088d234aee9553ec2e30e291

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Robocopy.exe
highLOL-Binary Copied From System DirectoryNasreddine Bencherchali (Nextron Systems)
mediumCopy From Or To Admin Share Or Sysvol FolderFlorian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
mediumPotential Browser Data StealingNasreddine Bencherchali (Nextron Systems)
mediumSuspicious Copy From or To System DirectoryFlorian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)

Sigma names Robocopy.exe in 5 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.