LOL · OtherMSBinary

coregen.exe

3 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Loads the target .DLL in arbitrary path specified with /L.

Use Execute DLL code

coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name

Context: user
Native: Execute
MITRE: T1055
Detection: Sigma: github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/image_load/image_load_side_load_coregen.yml
IOC: coregen.exe loading .dll file not in "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"
IOC: coregen.exe loading .dll file not named coreclr.dll
IOC: coregen.exe command line containing -L or -l
IOC: coregen.exe command line containing unexpected/invald assembly name
IOC: coregen.exe application crash by invalid assembly name
Refs: www.youtube.com/watch?v=75XImxOOInU
www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
lolbas-project.github.io/lolbas/OtherMSBinaries/coregen/

Execution Windows

Loads the coreclr.dll in the corgen.exe directory (e.g. C:\Program Files\Microsoft Silverlight\5.1.50918.0).

Use Execute DLL code

coregen.exe dummy_assembly_name

Context: user
Native: Execute
MITRE: T1055
Detection: Sigma: github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/image_load/image_load_side_load_coregen.yml
IOC: coregen.exe loading .dll file not in "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"
IOC: coregen.exe loading .dll file not named coreclr.dll
IOC: coregen.exe command line containing -L or -l
IOC: coregen.exe command line containing unexpected/invald assembly name
IOC: coregen.exe application crash by invalid assembly name
Refs: www.youtube.com/watch?v=75XImxOOInU
www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
lolbas-project.github.io/lolbas/OtherMSBinaries/coregen/

AWL / Policy Bypass Windows

Loads the target .DLL in arbitrary path specified with /L. Since binary is signed it can also be used to bypass application whitelisting solutions.

Use Execute DLL code

coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name

Context: user
Native: AWL Bypass
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/image_load/image_load_side_load_coregen.yml
IOC: coregen.exe loading .dll file not in "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"
IOC: coregen.exe loading .dll file not named coreclr.dll
IOC: coregen.exe command line containing -L or -l
IOC: coregen.exe command line containing unexpected/invald assembly name
IOC: coregen.exe application crash by invalid assembly name
Refs: www.youtube.com/watch?v=75XImxOOInU
www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
lolbas-project.github.io/lolbas/OtherMSBinaries/coregen/