Procedure examples

Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.

TONESHELL has used regsvr32.exe to execute the windows `DLLRegisterServer` function.

AppleSeed can call regsvr32.exe for execution.

Emotet uses RegSvr32 to execute the DLL payload.

Squirrelwaffle has been executed using `regsvr32.exe`.

Raspberry Robin uses regsvr32.exe execution without any command line parameters for command and control requests to IP addresses associated with Tor nodes.

Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.

Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.

Xbash can use regsvr32 for executing scripts.

Saint Bot has used `regsvr32` to execute scripts.

EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.

Mori can use `regsvr32.exe` for DLL execution.

RogueRobin uses regsvr32.exe to run a .sct file for execution.

Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.

Valak has used regsvr32.exe to launch malicious DLLs.

More_eggs has used regsvr32.exe to execute the malicious DLL.

Egregor has used regsvr32.exe to execute malicious DLLs.

Astaroth can be loaded through regsvr32.exe.

QakBot can use Regsvr32 to execute malicious DLLs.

Dridex can use `regsvr32.exe` to initiate malicious code.

HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.

Covenant can create SCT files for installation via `Regsvr32` to deploy new Grunt listeners.

Koadic can use Regsvr32 to execute additional payloads.