coregen.exe

Commands

1. ExecuteUser T1055

   Execute DLL code

   coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name

   Loads the target .DLL in arbitrary path specified with /L.

   os: Windows

   Execute: DLL

2. ExecuteUser T1055

   Execute DLL code

   coregen.exe dummy_assembly_name

   Loads the coreclr.dll in the corgen.exe directory (e.g. C:\Program Files\Microsoft Silverlight\5.1.50918.0).

   os: Windows

   Execute: DLL

3. AWL BypassUser T1218

   Execute DLL code

   coregen.exe /L {PATH_ABSOLUTE:.dll} dummy_assembly_name

   Loads the target .DLL in arbitrary path specified with /L. Since binary is signed it can also be used to bypass application whitelisting solutions.

   os: Windows

   Execute: DLL

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/image_load/image_load_side_load_coregen.yml
• IOCcoregen.exe loading .dll file not in "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\"
• IOCcoregen.exe loading .dll file not named coreclr.dll
• IOCcoregen.exe command line containing -L or -l
• IOCcoregen.exe command line containing unexpected/invald assembly name
• IOCcoregen.exe application crash by invalid assembly name

Resources

• https://www.youtube.com/watch?v=75XImxOOInU
• https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html