System Binary Proxy Execution: Rundll32

ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.^[6]

APT19 configured its payload to inject into the rundll32.exe.^[7]

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe "C:\Windows\twain_64.dll". APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.^{[8][6][9][10][11][12]}

APT29 has used Rundll32.exe to execute payloads.^[13][14][15]

APT3 has a tool that can run DLLs.^[16]

APT32 malware has used rundll32.exe to execute an initial infection process.^[17]

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.^[18]

APT41 has used rundll32.exe to execute a loader.^[19]

Attor's installer plugin can schedule rundll32.exe to load the dispatcher.^[20]

Backdoor.Oldrea can use rundll32 for execution on compromised hosts.^[21]

Bad Rabbit has used rundll32 to launch a malicious DLL as C:Windowsinfpub.dat.^[22]

Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\"vert" = "rundll32.exe c:\windows\temp\pvcu.dll , Qszdez".^[23]

BLINDINGCAN has used Rundll32 to load a malicious DLL.^[24]

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.^[25]

BoomBox can use RunDLL32 for execution.^[26]

Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.^[27]

Carbanak installs VNC server software that executes through rundll32.^[28]

Cobalt Strike can use rundll32.exe to load DLL from the command line.^[29]

Comnie uses Rundll32 to load a malicious DLL.^[30]

CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.^[31]

CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."^[32]

The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.^[33]

DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.^[34]

Egregor has used rundll32 during execution.^[35]

After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.^[36]

Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.^[37]

EnvyScout has the ability to proxy execution of malicious files with Rundll32.^[26]

EVILNUM can execute commands and scripts through rundll32.^[38]

FatDuke can execute via rundll32.^[39]

FELIXROOT uses Rundll32 for executing the dropper program.^[40][41]

Rundll32.exe is used as a way of executing Flame at the command-line.^[42]

Gamaredon Group malware has used rundll32 to launch additional malicious components.^[43]

A gh0st RAT variant has used rundll32 for execution.^[44]

GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).^[41]

HAFNIUM has used rundll32 to load malicious DLLs.^[45]

HermeticWizard has the ability to create a new process using rundll32.^[46]

InvisiMole has used rundll32.exe for execution.^[47]

JHUHUGIT is executed using rundll32.exe.^[48][49]

Kimsuky has used rundll32.exe to execute malicious scripts and malware on a victim's network.^[50]

Koadic can use Rundll32 to execute additional payloads.^[51]

KONNI has used Rundll32 to execute its loader for privilege escalation purposes.^[52][53]

Kwampirs uses rundll32.exe in a Registry value added to establish persistence.^[54]

Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.^[55][56][57]

LazyScripter has used rundll32.exe to execute Koadic stagers.^[58]

Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.^[59]

MegaCortex has used rundll32.exe to load a DLL for file encryption.^[60]

Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.^[61]

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.^[62]

NativeZone has used rundll32 to execute a malicious DLL.^[63]

NOKKI has used rundll32 for execution.^[64]

NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.^[65]

PolyglotDuke can be executed using rundll32.exe.^[39]

PowerDuke uses rundll32.exe to load.^[66]

Prikormka uses rundll32.exe to load its DLL.^[67]

Pteranodon executes functions using rundll32.exe.^[68]

PUNCHBUGGY can load a DLL using Rundll32.^[69]

QakBot can use Rundll32.exe to enable C2 communication.^{[70][71][72][73]}

Ragnar Locker has used rundll32.exe to execute components of VirtualBox.^[74]

RTM runs its core DLL file using rundll32.exe.^[75][76]

Sakula calls cmd.exe to run various DLL files via rundll32.^[77]

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.^[78]

ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.^[79]

Sibot has executed downloaded DLLs with rundll32.exe.^[80]

StreamEx uses rundll32 to call an exported function.^[81]

SUNBURST used Rundll32 to execute payloads.^[14]

TA505 has leveraged rundll32.exe to execute malicious DLLs.^[82][79]

TA551 has used rundll32.exe to load malicious DLLs.^[83]

USBferry can execute rundll32.exe in memory to avoid detection.^[84]

The Winnti for Windows installer loads a DLL using rundll32.^[85][86]

ZxShell has used rundll32.exe to execute other DLLs and named pipes.^[87]

Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using rundll32.exe to bypass application control.