LOL · Binary

Extexport.exe

1 technique WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Load a DLL located in the specified folder with one of the following names mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.

Use Execute dll file

Extexport.exe {PATH_ABSOLUTE:folder} foo bar

Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extexport.yml
IOC: Extexport.exe loads dll and is execute from other folder the original path
Refs: www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
lolbas-project.github.io/lolbas/Binaries/Extexport/