Procedure examples

Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.

RTM runs its core DLL file using rundll32.exe.

StrelaStealer DLL payloads have been executed via `rundll32.exe`.

Sakula calls cmd.exe to run various DLL files via rundll32.

Sibot has executed downloaded DLLs with rundll32.exe.

Kapeka is a Windows DLL file executed via ordinal by `rundll32.exe`.

Cobalt Strike can use `rundll32.exe` to load DLL from the command line.

SUNBURST used Rundll32 to execute payloads.

ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.

NativeZone has used rundll32 to execute a malicious DLL.

FunnyDream can use `rundll32` for execution of its components.

Kwampirs uses rundll32.exe in a Registry value added to establish persistence.

BoomBox can use RunDLL32 for execution.

DEADEYE can use `rundll32.exe` for execution of living off the land binaries (lolbin) such as `SHELL32.DLL`.

Egregor has used rundll32 during execution.

FELIXROOT uses Rundll32 for executing the dropper program.

ZxShell has used rundll32.exe to execute other DLLs and named pipes.

DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.

The Winnti for Windows installer loads a DLL using rundll32.

Troll Stealer is dropped as a DLL file and executed via `rundll32.exe` by its installer.

Heyoka Backdoor can use rundll32.exe to gain execution.

The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.

QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.

Comnie uses Rundll32 to load a malicious DLL.

ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.

HermeticWizard has the ability to create a new process using `rundll32`.

PcShare has used `rundll32.exe` for execution.

Koadic can use Rundll32 to execute additional payloads.

Rundll32.exe is used as a way of executing Flame at the command-line.

Hancitor has used verclsid.exe to download and execute a malicious script.

TONESHELL has injected its malicious payload into a running process through Windows utility Microsoft Application Virtualization Injector `MAVInject.exe`.

Lumma Stealer as leveraged Electron Applications to disable GPU sandboxing to avoid detection by security software.

TrickBot uses vncDll module to remote control the victim machine.

InvisibleFerret has utilized remote access software including AnyDesk client through the “adc” module. InvisibleFerret has also downloaded the AnyDesk client should it not already exist on the compromised host by searching for `C:/Program Files(x86)/AnyDesk/AnyDesk.exe`.

Hildegard has established tmate sessions for C2 communications.

Carbanak has a plugin for VNC and Ammyy Admin Tool.

RTM has the capability to download a VNC module from command and control (C2).

Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.

Dridex contains a module for VNC.

Qilin can use the Splashtop remote management service (SRManager.exe) to execute the Linux ransomware binary directly on Windows systems.

Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.

Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.

WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.

Qilin can use symbolic links to redirect file paths for remote and local objects and can use `chmod +x` to make its payload binary executable.

WastedLocker has a command to take ownership of a file and reset the ACL permissions using the takeown.exe /F filepath command.

BlackCat can use Windows commands such as `fsutil behavior set SymLinkEvaluation R2L:1` to redirect file system access to a different location after gaining access into compromised networks.

WannaCry uses attrib +h and icacls . /grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls.

BlackByte Ransomware uses the `mountvol.exe` command to mount volume names and leverages the Microsoft Discretionary Access Control List tool, `icacls.exe`, to grant the group to “Everyone” full access to the root of the drive.

Grandoreiro can modify the binary ACL to prevent security tools from running.

Ryuk can launch icacls <path> /grant Everyone:F /T /C /Q to delete every access-based restrictions on files and directories.