Identifier / Programs / Windows

wab.exe

Windows Contacts file version info (xCyclopedia)

LOLBAS Execute 2 Sigma rules name it 1 ATT&CK technique 1 documented command 2 known copies with hashes

How wab.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wab.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution Administrator privileges

Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice

wab.exe

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for wab.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wab.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highWab Execution From Non Default LocationNasreddine Bencherchali (Nextron Systems)

highWab/Wabmig Unusual Parent Or Child ProcessesNasreddine Bencherchali (Nextron Systems)

T1218System Binary Proxy Execution

Is it the real wab.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Windows Mail\
C:\Program Files\Windows Mail\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Contacts

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Mail\wab.exe · signed by Microsoft Windows

079ed81718d31ef8303df2350c72e452e6ce40cef8e048ef46350c4dfd6a78d0

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files\Windows Mail\wab.exe · signed by Microsoft Windows

b0bdb7af4b4e1c735791d5874691345d8d8f78149380e970b5f53f75c580ffeb

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.