Malware Deep Dive: Investigating a Foothold and Uncovering the Payload | Huntress

Huntress analysts investigated a persistent malicious foothold: a randomly named DLL loaded via a Run Key that invoked regsvr32.exe. Static strings/imports and a simple loader call graph suggested a loader; dynamic analysis (ProcMon, WinDbg) revealed the DLL decoded a payload in memory, used WinSock, and attempted a connection to 91.234.34.44:30970 — an IP linked to Vawtrak/Troj/Agent variants. The report documents the detection, forensic steps, IOCs, and remediation guidance.