Extexport.exe

Load a DLL located in the specified folder with one of the following names mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.

Use Execute dll file

Extexport.exe {PATH_ABSOLUTE:folder} foo bar

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extexport.yml

IOC: Extexport.exe loads dll and is execute from other folder the original path

Refs

www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/

lolbas-project.github.io/lolbas/Binaries/Extexport/