Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight. Located at: C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe; C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\coregen.exe.
coregencoregenSandbox: execFile · Timeout: 30s
security.execution.command security.defense-evasion.bypass Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Loads the target .DLL in arbitrary path specified with /L. (Execute DLL code)
coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_nameLoads the coreclr.dll in the corgen.exe directory (e.g. C:\Program Files\Microsoft Silverlight\5.1.50918.0). (Execute DLL code)
coregen.exe dummy_assembly_nameLoads the target .DLL in arbitrary path specified with /L. Since binary is signed it can also be used to bypass application whitelisting solutions. (Execute DLL code)
coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/image_load/image_load_side_load_coregen.yml |
| ioc | coregen.exe loading .dll file not in "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" |
| ioc | coregen.exe loading .dll file not named coreclr.dll |
| ioc | coregen.exe command line containing -L or -l |
| ioc | coregen.exe command line containing unexpected/invald assembly name |
| ioc | coregen.exe application crash by invalid assembly name |
coregen is a Windows LOLBin. Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight. Located at: C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe; C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\coregen.exe.