Skip to content

T1218.010 Regsvr32

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. 3

Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations. Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions. Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation. This method makes no changes to the Registry as the COM object is not actually registered, only executed. 2 This variation of the technique is often referred to as a “Squiblydoo” and has been used in campaigns targeting governments. 4 1

Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking. 4

Item Value
ID T1218.010
Sub-techniques T1218.001, T1218.002, T1218.003, T1218.004, T1218.005, T1218.007, T1218.008, T1218.009, T1218.010, T1218.011, T1218.012, T1218.013, T1218.014, T1218.015
Tactics TA0005
Platforms Windows
Version 2.2
Created 23 January 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S0622 AppleSeed AppleSeed can call regsvr32.exe for execution.40
G0073 APT19 APT19 used Regsvr32 to bypass application control techniques.54
G0050 APT32 APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.515253
S0373 Astaroth Astaroth can be loaded through regsvr32.exe.28
G0108 Blue Mockingbird Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.47
C0015 C0015 During C0015, the threat actors employed code that used regsvr32 for execution.56
G0080 Cobalt Group Cobalt Group has used regsvr32.exe to execute scripts.434445
S1155 Covenant Covenant can create SCT files for installation via Regsvr32 to deploy new Grunt listeners.13
G0009 Deep Panda Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.42
S0021 Derusbi Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.31
S0384 Dridex Dridex can use regsvr32.exe to initiate malicious code.29
S0554 Egregor Egregor has used regsvr32.exe to execute malicious DLLs.36
S0367 Emotet Emotet uses RegSvr32 to execute the DLL payload.22
S0568 EVILNUM EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.38
S0698 HermeticWizard HermeticWizard has used regsvr32.exe /s /i to execute malicious payloads.35
S0087 Hi-Zor Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.39
G0100 Inception Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.49
G0094 Kimsuky Kimsuky has executed malware with regsvr32s.48
S0250 Koadic Koadic can use Regsvr32 to execute additional payloads.12
G0065 Leviathan Leviathan has used regsvr32 for execution.23
S0284 More_eggs More_eggs has used regsvr32.exe to execute the malicious DLL.37
S1047 Mori Mori can use regsvr32.exe for DLL execution.27
C0022 Operation Dream Job During Operation Dream Job, Lazarus Group used regsvr32 to execute malware.55
S0229 Orz Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.23
S0650 QakBot QakBot can use Regsvr32 to execute malicious DLLs.201619181721
S0481 Ragnar Locker Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.34
S1130 Raspberry Robin Raspberry Robin uses regsvr32.exe execution without any command line parameters for command and control requests to IP addresses associated with Tor nodes.30
S0270 RogueRobin RogueRobin uses regsvr32.exe to run a .sct file for execution.32
S1018 Saint Bot Saint Bot has used regsvr32 to execute scripts.1415
S1030 Squirrelwaffle Squirrelwaffle has been executed using regsvr32.exe.26
G1053 Storm-0501 Storm-0501 has launched Cobalt Strike Beacon files using regsvr32.exe.46
G0127 TA551 TA551 has used regsvr32.exe to load malicious DLLs.25
S1239 TONESHELL TONESHELL has used regsvr32.exe to execute the windows DLLRegisterServer function.33
S0476 Valak Valak has used regsvr32.exe to launch malicious DLLs.2425
G0090 WIRTE WIRTE has used regsvr32.exe to trigger the execution of a malicious script.50
S0341 Xbash Xbash can use regsvr32 for executing scripts.41

Mitigations

ID Mitigation Description
M1050 Exploit Protection Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block regsvr32.exe from being used to bypass application control. 9 Identify and block potentially malicious software executed through regsvr32 functionality by using application control 5 tools, like Windows Defender Application Control7, AppLocker, 11 10 or Software Restriction Policies 6 where appropriate. 8

References

  1. Anubhav, A., Kizhakkinan, D. (2017, February 22). Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government. Retrieved February 24, 2017. ↩

  2. LOLBAS. (n.d.). Regsvr32.exe. Retrieved July 31, 2019. ↩

  3. Microsoft. (2015, August 14). How to use the Regsvr32 tool and troubleshoot Regsvr32 error messages. Retrieved June 22, 2016. ↩

  4. Nolen, R. et al.. (2016, April 28). Threat Advisory: “Squiblydoo” Continues Trend of Attackers Using Native OS Tools to “Live off the Land”. Retrieved April 9, 2018. ↩↩

  5. Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014. ↩

  6. Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved September 12, 2024. ↩

  7. Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019. ↩

  8. Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016. ↩

  9. National Security Agency. (2016, May 4). Secure Host Baseline EMET. Retrieved June 22, 2016. ↩

  10. NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016. ↩

  11. Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016. ↩

  12. Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024. ↩

  13. cobbr. (2021, April 21). Covenant. Retrieved September 4, 2024. ↩

  14. Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022. ↩

  15. Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022. ↩

  16. Cyberint. (2021, May 25). Qakbot Banking Trojan. Retrieved September 27, 2021. ↩

  17. Inman, R. and Gurney, P. (2022, June 6). Shining the Light on Black Basta. Retrieved March 8, 2023. ↩

  18. Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023. ↩

  19. Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021. ↩

  20. Rainey, K. (n.d.). Qbot. Retrieved September 27, 2021. ↩

  21. Vilkomir-Preisman, S. (2022, August 18). Beating Black Basta Ransomware. Retrieved March 8, 2023. ↩

  22. Kenefick, I. (2023, March 13). Emotet Returns, Now Adopts Binary Padding for Evasion. Retrieved June 19, 2024. ↩

  23. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018. ↩↩

  24. Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020. ↩

  25. Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020. ↩↩

  26. Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022. ↩

  27. FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022. ↩

  28. Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019. ↩

  29. Red Canary. (2021, February 9). Dridex - Red Canary Threat Detection Report. Retrieved August 3, 2023. ↩

  30. Lauren Podber and Stef Rand. (2022, May 5). Raspberry Robin gets the worm early. Retrieved May 17, 2024. ↩

  31. Fidelis Threat Research Team. (2016, May 2). Turbo Twist: Two 64-bit Derusbi Strains Converge. Retrieved August 16, 2018. ↩

  32. Lee, B., Falcone, R. (2019, January 18). DarkHydrus delivers new Trojan that can use Google Drive for C2 communications. Retrieved April 17, 2019. ↩

  33. Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025. ↩

  34. SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020. ↩

  35. ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022. ↩

  36. Joe Security. (n.d.). Analysis Report fasm.dll. Retrieved November 17, 2024. ↩

  37. Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019. ↩

  38. Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021. ↩

  39. Fidelis Cybersecurity. (2015, December 16). Fidelis Threat Advisory #1020: Dissecting the Malware Involved in the INOCNATION Campaign. Retrieved November 17, 2024. ↩

  40. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. ↩

  41. Xiao, C. (2018, September 17). Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows. Retrieved November 14, 2018. ↩

  42. RSA Incident Response. (2014, January). RSA Incident Response Emerging Threat Profile: Shell Crew. Retrieved January 14, 2016. ↩

  43. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018. ↩

  44. Gorelik, M. (2018, October 08). Cobalt Group 2.0. Retrieved November 5, 2018. ↩

  45. Giagone, R., Bermejo, L., and Yarochkin, F. (2017, November 20). Cobalt Strikes Again: Spam Runs Use Macros and CVE-2017-8759 Exploit Against Russian Banks. Retrieved March 7, 2019. ↩

  46. Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025. ↩

  47. Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020. ↩

  48. KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024. ↩

  49. GReAT. (2014, December 10). Cloud Atlas: RedOctober APT is back in style. Retrieved May 8, 2020. ↩

  50. S2 Grupo. (2019, April 2). WIRTE Group attacking the Middle East. Retrieved May 24, 2019. ↩

  51. Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019. ↩

  52. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017. ↩

  53. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. ↩

  54. Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018. ↩

  55. Breitenbacher, D and Osis, K. (2020, June 17). OPERATION IN(TER)CEPTION: Targeted Attacks Against European Aerospace and Military Companies. Retrieved December 20, 2021. ↩

  56. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022. ↩