.. /coregen.exe
Star

Execute (DLL)
AWL bypass (DLL)

Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within “C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Loads the target .DLL in arbitrary path specified with /L.

    coregen.exe /L C:\folder\evil.dll dummy_assembly_name
    Use case
    Execute DLL code
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1055
    Tags
    Execute: DLL
    This LOLBAS executes Dynamic-Link Libraries (DLLs).

  2. Loads the coreclr.dll in the corgen.exe directory (e.g. C:\Program Files\Microsoft Silverlight\5.1.50918.0).

    coregen.exe dummy_assembly_name
    Use case
    Execute DLL code
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1055

AWL bypass

  1. Loads the target .DLL in arbitrary path specified with /L. Since binary is signed it can also be used to bypass application whitelisting solutions.

    coregen.exe /L C:\folder\evil.dll dummy_assembly_name
    Use case
    Execute DLL code
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1218
    Tags
    Execute: DLL
    This LOLBAS executes Dynamic-Link Libraries (DLLs).