Procedure examples

Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.

Valak has used regsvr32.exe to launch malicious DLLs.

More_eggs has used regsvr32.exe to execute the malicious DLL.

Egregor has used regsvr32.exe to execute malicious DLLs.

Astaroth can be loaded through regsvr32.exe.

QakBot can use Regsvr32 to execute malicious DLLs.

Dridex can use `regsvr32.exe` to initiate malicious code.

HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.

Covenant can create SCT files for installation via `Regsvr32` to deploy new Grunt listeners.

Koadic can use Regsvr32 to execute additional payloads.

PowerDuke uses rundll32.exe to load.

BLINDINGCAN has used Rundll32 to load a malicious DLL.

Ninja loader components can be executed through rundll32.exe.

Bumblebee has used `rundll32` for execution of the loader component.

NOKKI has used rundll32 for execution.

Backdoor.Oldrea can use rundll32 for execution on compromised hosts.

Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.

Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.

Bad Rabbit has used rundll32 to launch a malicious DLL as C:Windowsinfpub.dat.

EnvyScout has the ability to proxy execution of malicious files with Rundll32.

GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).

Prikormka uses rundll32.exe to load its DLL.

Squirrelwaffle has been executed using `rundll32.exe`.

PolyglotDuke can be executed using rundll32.exe.

FlawedAmmyy has used `rundll32` for execution.

InvisiMole has used rundll32.exe for execution.

Raspberry Robin uses rundll32 execution without any command line parameters to contact command and control infrastructure, such as IP addresses associated with Tor nodes.

Mispadu uses RunDLL32 for execution via its injector DLL.

IcedID has used rundll32.exe to execute the IcedID loader.

Ragnar Locker has used rundll32.exe to execute components of VirtualBox.

FatDuke can execute via rundll32.

NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.

PUNCHBUGGY can load a DLL using Rundll32.

Pteranodon executes functions using rundll32.exe.

CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."

Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”.

Mongall can use `rundll32.exe` for execution.

SVCReady has used `rundll32.exe` for execution.

After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.

USBferry can execute rundll32.exe in memory to avoid detection.

Latrodectus can use rundll32.exe to execute downloaded DLLs.

Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.

EVILNUM can execute commands and scripts through rundll32.

KONNI has used Rundll32 to execute its loader for privilege escalation purposes.

A gh0st RAT variant has used rundll32 for execution.

JHUHUGIT is executed using rundll32.exe.

Attor's installer plugin can schedule rundll32.exe to load the dispatcher.

MegaCortex has used rundll32.exe to load a DLL for file encryption.

StreamEx uses rundll32 to call an exported function.

SDBbot has used rundll32.exe to execute DLLs.