odbcconf.exe

  • File Path: C:\WINDOWS\system32\odbcconf.exe
  • Description: ODBC Driver Configuration Program

Screenshot

odbcconf.exe

Hashes

Type Hash
MD5 EAF00070639A42055029B1F22FD75ABC
SHA1 2FE199C5033F90DA6A2DA58B792965A31632F980
SHA256 E626FA3DB43757AF2AEFF442847CA68402929D826DA9160692B6220338FBDEB8
SHA384 E983221B2F9D4CF7F3A08CEB94364DE316CA244FFE32B8ABA7F74522058581EB5D76654E7E2DACA066F115460F9E0DBE
SHA512 64325787ABF5C88CA1E47BE6BFA8AF448332AD89BED94AC8D8609E1F49FECE8FBDA35461D245E6789DD6AC6F49A781283D5CFB19D9DA799CF6A16A63D6C39FF1
SSDEEP 768:MFr3bf13VACISsdb1i7sjI179wnOEmCP0ZxM:Mph3VACISsd5i7l798hmjM

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: odbcconf.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.18362.1 (WinBuild.160101.0800)
  • Product Version: 10.0.18362.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of odbcconf.exe being misused. While odbcconf.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_susp_odbcconf.yml title: Application Whitelisting Bypass via DLL Loaded by odbcconf.exe DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml description: Detects defence evasion attempt via odbcconf.exe execution to load DLL DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Odbcconf.yml DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml Image\|endswith: '\odbcconf.exe' DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml ParentImage\|endswith: '\odbcconf.exe' DRL 1.0
sigma proc_creation_win_susp_odbcconf.yml - Legitimate use of odbcconf.exe by legitimate user DRL 1.0
LOLBAS Odbcconf.yml Name: Odbcconf.exe  
LOLBAS Odbcconf.yml - Command: odbcconf -f file.rsp  
LOLBAS Odbcconf.yml - Command: odbcconf /a {REGSVR c:\test\test.dll}  
LOLBAS Odbcconf.yml - Path: C:\Windows\System32\odbcconf.exe  
LOLBAS Odbcconf.yml - Path: C:\Windows\SysWOW64\odbcconf.exe  
atomic-red-team index.md - T1218.008 Odbcconf MIT License. © 2018 Red Canary
atomic-red-team index.md - Atomic Test #1: Odbcconf.exe - Execute Arbitrary DLL [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - T1218.008 Odbcconf MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #1: Odbcconf.exe - Execute Arbitrary DLL [windows] MIT License. © 2018 Red Canary
atomic-red-team matrix.md | | | Shortcut Modification | Valid Accounts CONTRIBUTE A TEST | Odbcconf | | | | | | | | MIT License. © 2018 Red Canary
atomic-red-team windows-matrix.md | | | Shortcut Modification | Winlogon Helper DLL | Odbcconf | | | | | | | | MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md # T1218.008 - Odbcconf MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md <blockquote>Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) Odbcconf.exe is digitally signed by Microsoft. MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A {REGSVR "C:\Users\Public\file.dll"}). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017) MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md - Atomic Test #1 - Odbcconf.exe - Execute Arbitrary DLL MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md ## Atomic Test #1 - Odbcconf.exe - Execute Arbitrary DLL MIT License. © 2018 Red Canary
atomic-red-team T1218.008.md odbcconf.exe /S /A {REGSVR “#{dll_payload}”} MIT License. © 2018 Red Canary
stockpile a74bc239-a196-4f7e-8d5c-fe8c0266071c.yml name: Signed Binary Execution - odbcconf Apache-2.0
stockpile a74bc239-a196-4f7e-8d5c-fe8c0266071c.yml description: Leverage odbcconf for DLL injection Apache-2.0
stockpile a74bc239-a196-4f7e-8d5c-fe8c0266071c.yml odbcconf.exe /S /A {REGSVR "C:\Users\Public\sandcat.dll"} Apache-2.0

MIT License. Copyright (c) 2020-2021 Strontic.