LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Replace.exe

View source

Used to replace file with another file

CopyDownload
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Copy1

EXAMPLE 01T1105

Copy .cab file to destination

COMMAND
replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A
USE CASE
Copy files
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Download1

EXAMPLE 01T1105

Download/Copy executable to specified folder

COMMAND
replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /A
USE CASE
Download file
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\replace.exe
C:\Windows\SysWOW64\replace.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Replace.exe retrieving files from remote server

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

elceef@elceef