LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

coregen.exe

View source

Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.

ExecuteAWL Bypass
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute2

EXAMPLE 01T1055

Loads the target .DLL in arbitrary path specified with /L.

COMMAND
coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name
USE CASE
Execute DLL code
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · DLL
EXAMPLE 02T1055

Loads the coreclr.dll in the corgen.exe directory (e.g. C:\Program Files\Microsoft Silverlight\5.1.50918.0).

COMMAND
coregen.exe dummy_assembly_name
USE CASE
Execute DLL code
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · DLL

AWL Bypass1

EXAMPLE 01T1218

Loads the target .DLL in arbitrary path specified with /L. Since binary is signed it can also be used to bypass application whitelisting solutions.

COMMAND
coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name
USE CASE
Execute DLL code
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · DLL
02 / ON DISK

Known paths

C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\coregen.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    coregen.exe loading .dll file not in "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"

  • IOC

    coregen.exe loading .dll file not named coreclr.dll

  • IOC

    coregen.exe command line containing -L or -l

  • IOC

    coregen.exe command line containing unexpected/invald assembly name

  • IOC

    coregen.exe application crash by invalid assembly name

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Nicky Tyrer
Evan Pena
Casey Erikson