Procedure examples

FIN7 has used `rundll32.exe` to execute malware on a compromised network.

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.

UNC3886 has used rundll32.exe to execute MiniDump for dumping LSASS process memory.

Carbanak installs VNC server software that executes through rundll32.

Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.

Storm-0501 has launched Cobalt Strike Beacon files with rundll32.exe.

TA505 has leveraged rundll32.exe to execute malicious DLLs.

RedCurl has used rundll32.exe to execute malicious files.

TA551 has used rundll32.exe to load malicious DLLs.

LazyScripter has used `rundll32.exe` to execute Koadic stagers.

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.

Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.

CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.

Wizard Spider has utilized `rundll32.exe` to deploy ransomware commands with the use of WebDAV.

Daggerfly proxied execution of malicious DLLs through a renamed rundll32.exe binary.

Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.

APT19 configured its payload to inject into the rundll32.exe.

PowerDuke uses rundll32.exe to load.

BLINDINGCAN has used Rundll32 to load a malicious DLL.

Ninja loader components can be executed through rundll32.exe.

Bumblebee has used `rundll32` for execution of the loader component.

NOKKI has used rundll32 for execution.

Backdoor.Oldrea can use rundll32 for execution on compromised hosts.

Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.

Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.

Bad Rabbit has used rundll32 to launch a malicious DLL as C:Windowsinfpub.dat.

EnvyScout has the ability to proxy execution of malicious files with Rundll32.

GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).

Prikormka uses rundll32.exe to load its DLL.

Squirrelwaffle has been executed using `rundll32.exe`.

PolyglotDuke can be executed using rundll32.exe.

FlawedAmmyy has used `rundll32` for execution.

InvisiMole has used rundll32.exe for execution.

Raspberry Robin uses rundll32 execution without any command line parameters to contact command and control infrastructure, such as IP addresses associated with Tor nodes.

Mispadu uses RunDLL32 for execution via its injector DLL.

IcedID has used rundll32.exe to execute the IcedID loader.

Ragnar Locker has used rundll32.exe to execute components of VirtualBox.

FatDuke can execute via rundll32.

NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.

PUNCHBUGGY can load a DLL using Rundll32.

Pteranodon executes functions using rundll32.exe.

CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."

Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”.

Mongall can use `rundll32.exe` for execution.

SVCReady has used `rundll32.exe` for execution.

After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.

USBferry can execute rundll32.exe in memory to avoid detection.

Latrodectus can use rundll32.exe to execute downloaded DLLs.

Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.