Procedure examples

EVILNUM can execute commands and scripts through rundll32.

KONNI has used Rundll32 to execute its loader for privilege escalation purposes.

A gh0st RAT variant has used rundll32 for execution.

JHUHUGIT is executed using rundll32.exe.

Attor's installer plugin can schedule rundll32.exe to load the dispatcher.

MegaCortex has used rundll32.exe to load a DLL for file encryption.

StreamEx uses rundll32 to call an exported function.

SDBbot has used rundll32.exe to execute DLLs.

Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.

RTM runs its core DLL file using rundll32.exe.

StrelaStealer DLL payloads have been executed via `rundll32.exe`.

Sakula calls cmd.exe to run various DLL files via rundll32.

Sibot has executed downloaded DLLs with rundll32.exe.

Kapeka is a Windows DLL file executed via ordinal by `rundll32.exe`.

Cobalt Strike can use `rundll32.exe` to load DLL from the command line.

SUNBURST used Rundll32 to execute payloads.

ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.

NativeZone has used rundll32 to execute a malicious DLL.

FunnyDream can use `rundll32` for execution of its components.

Kwampirs uses rundll32.exe in a Registry value added to establish persistence.

BoomBox can use RunDLL32 for execution.

DEADEYE can use `rundll32.exe` for execution of living off the land binaries (lolbin) such as `SHELL32.DLL`.

Egregor has used rundll32 during execution.

FELIXROOT uses Rundll32 for executing the dropper program.

ZxShell has used rundll32.exe to execute other DLLs and named pipes.

DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.

The Winnti for Windows installer loads a DLL using rundll32.

Troll Stealer is dropped as a DLL file and executed via `rundll32.exe` by its installer.

Heyoka Backdoor can use rundll32.exe to gain execution.

The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.

QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.

Comnie uses Rundll32 to load a malicious DLL.

ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.

HermeticWizard has the ability to create a new process using `rundll32`.

PcShare has used `rundll32.exe` for execution.

Koadic can use Rundll32 to execute additional payloads.

Rundll32.exe is used as a way of executing Flame at the command-line.

Hancitor has used verclsid.exe to download and execute a malicious script.

TONESHELL has injected its malicious payload into a running process through Windows utility Microsoft Application Virtualization Injector `MAVInject.exe`.

Mustang Panda used Microsoft Management Console Snap-In Control files, or MSC files, executed via MMC to run follow-on PowerShell commands during RedDelta Modified PlugX Infection Chain Operations.

Medusa Group has leveraged Microsoft Management Console (MMC) to facilitate lateral movement and to interact locally or remotely with victim devices using the command `mmc.exe compmgmt.msc /computer:{hostname/ip}`.

During the 3CX Supply Chain Attack, AppleJeus leveraged the 3CX application's electron framework to execute its malicious libraries under the official 3CX electron application.

Lumma Stealer as leveraged Electron Applications to disable GPU sandboxing to avoid detection by security software.

During Operation AkaiRyū, MirrorFace used remote access tools including PuTTY.

During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.

BlackByte has used tools such as AnyDesk in victim environments.

TeamTNT has established tmate sessions for C2 communications.

FIN7 has utilized the remote management tool Atera to download malware to a compromised system.

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.

Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.