Procedure examples

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.

APT3 has a tool that can run DLLs.

Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.

APT41 has used rundll32.exe to execute a loader.

APT32 malware has used rundll32.exe to execute an initial infection process.

HAFNIUM has used rundll32 to load malicious DLLs.

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.

Gamaredon Group malware has used rundll32 to launch additional malicious components.

FIN7 has used `rundll32.exe` to execute malware on a compromised network.

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.

UNC3886 has used rundll32.exe to execute MiniDump for dumping LSASS process memory.

Carbanak installs VNC server software that executes through rundll32.

Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.

Storm-0501 has launched Cobalt Strike Beacon files with rundll32.exe.

TA505 has leveraged rundll32.exe to execute malicious DLLs.

RedCurl has used rundll32.exe to execute malicious files.

TA551 has used rundll32.exe to load malicious DLLs.

LazyScripter has used `rundll32.exe` to execute Koadic stagers.

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.

Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.

CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.

Wizard Spider has utilized `rundll32.exe` to deploy ransomware commands with the use of WebDAV.

Daggerfly proxied execution of malicious DLLs through a renamed rundll32.exe binary.

Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.

APT19 configured its payload to inject into the rundll32.exe.