Procedure examples

Kimsuky has executed malware with regsvr32s.

APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.

Leviathan has used regsvr32 for execution.

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.

Storm-0501 has launched Cobalt Strike Beacon files using regsvr32.exe.

TA551 has used regsvr32.exe to load malicious DLLs.

Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.

Cobalt Group has used regsvr32.exe to execute scripts.

Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.

WIRTE has used `regsvr32.exe` to trigger the execution of a malicious script.

APT19 used Regsvr32 to bypass application control techniques.

Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.

TONESHELL has used regsvr32.exe to execute the windows `DLLRegisterServer` function.

AppleSeed can call regsvr32.exe for execution.

Emotet uses RegSvr32 to execute the DLL payload.

Squirrelwaffle has been executed using `regsvr32.exe`.

Raspberry Robin uses regsvr32.exe execution without any command line parameters for command and control requests to IP addresses associated with Tor nodes.

Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.

Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.

Xbash can use regsvr32 for executing scripts.

Saint Bot has used `regsvr32` to execute scripts.

EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.

Mori can use `regsvr32.exe` for DLL execution.

RogueRobin uses regsvr32.exe to run a .sct file for execution.

Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.

Valak has used regsvr32.exe to launch malicious DLLs.

More_eggs has used regsvr32.exe to execute the malicious DLL.

Egregor has used regsvr32.exe to execute malicious DLLs.

Astaroth can be loaded through regsvr32.exe.

QakBot can use Regsvr32 to execute malicious DLLs.

Dridex can use `regsvr32.exe` to initiate malicious code.

HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.

Covenant can create SCT files for installation via `Regsvr32` to deploy new Grunt listeners.

Koadic can use Regsvr32 to execute additional payloads.

During Operation Dream Job, Lazarus Group executed malware with `C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db"`, `CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905`.

During the 2015 Ukraine Electric Power Attack, Sandworm Team used a backdoor which could execute a supplied DLL using `rundll32.exe`.

During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers.

During C0018, the threat actors used `rundll32` to run Mimikatz.

Water Curupira Pikabot Distribution utilizes rundll32.exe to execute the final Pikabot payload, using the named exports `Crash` or `Limit` depending on the variant.

During C0021, the threat actors used `rundll32.exe` to execute the Cobalt Strike Beacon loader DLL.

During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.

During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads.

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.

APT3 has a tool that can run DLLs.

Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.

APT41 has used rundll32.exe to execute a loader.

APT32 malware has used rundll32.exe to execute an initial infection process.

HAFNIUM has used rundll32 to load malicious DLLs.

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.

Gamaredon Group malware has used rundll32 to launch additional malicious components.