Procedure examples

PowerDuke uses rundll32.exe to load.

BLINDINGCAN has used Rundll32 to load a malicious DLL.

Ninja loader components can be executed through rundll32.exe.

Bumblebee has used `rundll32` for execution of the loader component.

NOKKI has used rundll32 for execution.

Backdoor.Oldrea can use rundll32 for execution on compromised hosts.

Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.

Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.

Bad Rabbit has used rundll32 to launch a malicious DLL as C:Windowsinfpub.dat.

EnvyScout has the ability to proxy execution of malicious files with Rundll32.

GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).

Prikormka uses rundll32.exe to load its DLL.

Squirrelwaffle has been executed using `rundll32.exe`.

PolyglotDuke can be executed using rundll32.exe.

FlawedAmmyy has used `rundll32` for execution.

InvisiMole has used rundll32.exe for execution.

Raspberry Robin uses rundll32 execution without any command line parameters to contact command and control infrastructure, such as IP addresses associated with Tor nodes.

Mispadu uses RunDLL32 for execution via its injector DLL.

IcedID has used rundll32.exe to execute the IcedID loader.

Ragnar Locker has used rundll32.exe to execute components of VirtualBox.

FatDuke can execute via rundll32.

NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.

PUNCHBUGGY can load a DLL using Rundll32.

Pteranodon executes functions using rundll32.exe.

CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."

Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”.

Mongall can use `rundll32.exe` for execution.

SVCReady has used `rundll32.exe` for execution.

After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.

USBferry can execute rundll32.exe in memory to avoid detection.

Latrodectus can use rundll32.exe to execute downloaded DLLs.

Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.

EVILNUM can execute commands and scripts through rundll32.

KONNI has used Rundll32 to execute its loader for privilege escalation purposes.

A gh0st RAT variant has used rundll32 for execution.

JHUHUGIT is executed using rundll32.exe.

Attor's installer plugin can schedule rundll32.exe to load the dispatcher.

MegaCortex has used rundll32.exe to load a DLL for file encryption.

StreamEx uses rundll32 to call an exported function.

SDBbot has used rundll32.exe to execute DLLs.

Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.

RTM runs its core DLL file using rundll32.exe.

StrelaStealer DLL payloads have been executed via `rundll32.exe`.

Sakula calls cmd.exe to run various DLL files via rundll32.

Sibot has executed downloaded DLLs with rundll32.exe.

Kapeka is a Windows DLL file executed via ordinal by `rundll32.exe`.

Cobalt Strike can use `rundll32.exe` to load DLL from the command line.

SUNBURST used Rundll32 to execute payloads.

ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.

NativeZone has used rundll32 to execute a malicious DLL.