Extexport.exe

type: OSBinaries

Load a DLL located in the c:\test folder with a specific name.

Full path

C:\Program Files\Internet Explorer\Extexport.exe
C:\Program Files (x86)\Internet Explorer\Extexport.exe

Commands

ExecuteUser T1218
Execute dll file
```
Extexport.exe {PATH_ABSOLUTE:folder} foo bar
```
Load a DLL located in the specified folder with one of the following names mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute: DLL

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extexport.yml
IOCExtexport.exe loads dll and is execute from other folder the original path

Resources

http://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/

acknowledgement: Adam @hexacorn