odbcconf.exe

  • File Path: C:\WINDOWS\system32\odbcconf.exe
  • Description: ODBC Driver Configuration Program

Screenshot

odbcconf.exe

Hashes

Type Hash
MD5 07FBA12552331355C103999806627314
SHA1 20C5166C62B81B9F83B4B981D9B7B5DA3FBB6758
SHA256 E181C538C72CD7B82F3081A1039042A05637F926665E6B7F5AAF61F5F8C7DECF
SHA384 F179535A17177F64F219653EAF51B7C867E1F672D29C8C4C0A9EA5BFC07BB84016F66CE86BEA4F80D64D7D9291323488
SHA512 A48A5D313FBCEE73E112230DF16CF439BC315E804E575897D28BAC11D2BB5B5F2566B1B54D6A91C2B8D614DFCA28F546D0E0BC2E5E8F068D80271BD5E3464443
SSDEEP 768:XSZSkttn+lUiiX14Ptum4gsGML/u1e55ueUBe:XSZcl8fm4gsGML/uMqe
IMP 09AE8655C843B33D7FA4CDD4F87AD0BF
PESHA1 72DE879E1D7154E23D6A57AFE51C996CBEA643B2
PE256 A82A9C07705D84BBFD0CD8C0087D28C7D7ED0EF4D808CD75E04B3C708A851CC1

Runtime Data

Window Title:

Invalid Parameter

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\odbcconf.exe.mui File
(RW-) C:\Windows\System32 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\Windows\Theme1077709572 Section
\Windows\Theme3461253685 Section

Loaded Modules:

Path
C:\WINDOWS\System32\ADVAPI32.dll
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\system32\odbcconf.exe
C:\WINDOWS\System32\RPCRT4.dll
C:\WINDOWS\System32\sechost.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: odbcconf.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/e181c538c72cd7b82f3081a1039042a05637f926665e6b7f5aaf61f5f8c7decf/detection

Possible Misuse

The following table contains possible examples of odbcconf.exe being misused. While odbcconf.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_susp_odbcconf.yml title: Application Whitelisting Bypass via DLL Loaded by odbcconf.exe DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml description: Detects defence evasion attempt via odbcconf.exe execution to load DLL DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Odbcconf.yml DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml Image\|endswith: '\odbcconf.exe' DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml ParentImage\|endswith: '\odbcconf.exe' DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml - Legitimate use of odbcconf.exe by legitimate user DRL 1.0
LOLBAS Odbcconf.yml Name: Odbcconf.exe  
LOLBAS Odbcconf.yml - Command: odbcconf -f file.rsp  
LOLBAS Odbcconf.yml - Command: odbcconf /a {REGSVR c:\test\test.dll}  
LOLBAS Odbcconf.yml - Path: C:\Windows\System32\odbcconf.exe  
LOLBAS Odbcconf.yml - Path: C:\Windows\SysWOW64\odbcconf.exe  
atomic-red-team index.md - T1218.008 Odbcconf MIT License. © 2018 Red Canary
atomic-red-team index.md - Atomic Test #1: Odbcconf.exe - Execute Arbitrary DLL [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - T1218.008 Odbcconf MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #1: Odbcconf.exe - Execute Arbitrary DLL [windows] MIT License. © 2018 Red Canary
atomic-red-team matrix.md | | | Shortcut Modification | Valid Accounts CONTRIBUTE A TEST | Odbcconf | | | | | | | | MIT License. © 2018 Red Canary
atomic-red-team windows-matrix.md | | | Shortcut Modification | Winlogon Helper DLL | Odbcconf | | | | | | | | MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md # T1218.008 - Odbcconf MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md <blockquote>Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) Odbcconf.exe is digitally signed by Microsoft. MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md - Atomic Test #1 - Odbcconf.exe - Execute Arbitrary DLL MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md ## Atomic Test #1 - Odbcconf.exe - Execute Arbitrary DLL MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md odbcconf.exe /S /A {REGSVR “#{dll_payload}”} MIT License. © 2018 Red Canary
stockpile a74bc239-a196-4f7e-8d5c-fe8c0266071c.yml name: Signed Binary Execution - odbcconf Apache-2.0
stockpile a74bc239-a196-4f7e-8d5c-fe8c0266071c.yml description: Leverage odbcconf for DLL injection Apache-2.0
stockpile a74bc239-a196-4f7e-8d5c-fe8c0266071c.yml odbcconf.exe /S /A {REGSVR "C:\Users\Public\sandcat.dll"} Apache-2.0

MIT License. Copyright (c) 2020-2021 Strontic.