RegAsm.exe
Sources: 300M+ executions observed in the wild.
Summary
.NET Assembly Registration Utility. Registers .NET COM-callable assemblies in the Windows registry. Abused as a LOLBin to execute arbitrary code via custom registration functions in .NET DLLs.
RegAsm.exe is the 1996th most commonly executed Windows program in EchoTrail's dataset, observed 311 times across enterprise environments. It typically runs from C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and it is most often launched by msiexec.exe.
Get this in your tools
The same record for regasm.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/regasm.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\Microsoft.NET\Framework64\v4.0.3031986.5%
- C:\ProgramData\...5.79%
- C:\Windows\Microsoft.NET\Framework64\v2.0.507273.86%
- C:\Windows\Microsoft.NET\Framework\v4.0.303192.57%
- C:\Users\...0.64%
- C:\Windows\Microsoft.NET\Framework\v2.0.507270.64%
Top Hashes (SHA256)
- 00271881346e8c7fcf324686631894b977cf0f43a26a2fed8554b9b604a0bd5d26.94%
- 1136010a4706295f80343fe364d90d5789288dead5ab0ed0e0981d29ad669bbc14.44%
- de6213ea0a5b21e97dcc862b8545f33784259746ab1797e7805b092861a60d187.5%
- 1e9516da2ded24d635f5fab0347d34ceb76e50b2a015ebb1ee3b8ee69de5faae5.42%
- 008407b2ae592dd1e3e2dcc1709bb743dd42415155aca155a94e2da090778f875.14%
- c5e6e5e81118950386193e8a544a40c0ef9b64a557e55640a0e7494e547240005.14%
- dc45704ba97d974d157c1c4a27dba402afa595eac2468d8def2ee8d0a2ee9a815.14%
- 1fa317b9977f8ce780c1bb39567347d233f87646997f55fd6de16c306fbd44e13.75%
- 17d7cdfd341268f548c9cff3761209bd8b9f2c74993a77e8148a0f058b57dd912.92%
- 19c4a41aad4928ff060b869758ac00125e37eafdb6085a34c2d5b25b9d19842b2.36%
Process Ancestry
Top Grandparents
- msiexec.exe39.07%
- powershell.exe38.6%
- services.exe10.47%
- DAX3API.exe1.86%
- explorer.exe0.47%
- setup.exe0.23%
Top Parents
- msiexec.exe55.11%
- powershell.exe26.34%
- cmd.exe5.24%
- drvinst.exe0.4%
Top Children
- conhost.exe100%
Security Analysis
What does RegAsm.exe normally do?
Runs from .NET Framework directory. Used during software installation to register .NET assemblies for COM interop. Short-lived. Uncommon in most environments.
When is RegAsm.exe suspicious?
Loading DLLs from temp directories, user profile paths, or network shares. Spawning child processes (cmd.exe, powershell.exe). Network connections. Execution outside of software installation context.
How do attackers abuse RegAsm.exe?
regasm.exe executes code in .NET assemblies through COM registration entry points (RegisterClass/UnregisterClass). 1. CUSTOM REGISTRATION FUNCTION: Attackers compile a DLL with [ComRegisterFunction] or [ComUnregisterFunction] attributes containing malicious code. Running "regasm.exe /U malicious.dll" executes the code. 2. APPLICATION WHITELISTING BYPASS: Signed Microsoft binary allowed by default policies. 3. PROXY EXECUTION: The malicious code runs in regasm.exe process context, potentially evading detections focused on direct script execution.
Detection guidance
HIGH-CONFIDENCE DETECTIONS: - regasm.exe loading DLLs from %TEMP%, %APPDATA%, Downloads, or network paths - regasm.exe spawning child processes or making network connections - regasm.exe run outside of software installation context DATA SOURCES: Process creation (Sysmon 1), module load (Sysmon 7)
False positive notes
Legitimate during .NET COM interop assembly registration, typically during software installation. Some enterprise applications register COM components at install time.
Related Processes
Ask Rocky about RegAsm.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for RegAsm.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.