Signed Binary Proxy Execution: Rundll32

ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.^[23]

APT19 configured its payload to inject into the rundll32.exe.^[40]

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe "C:\Windows\twain_64.dll". APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.^{[41][23][42][43][44]}

APT29 has used rundll32.exe for execution.^[48]

APT3 has a tool that can run DLLs.^[45]

APT32 malware has used rundll32.exe to execute an initial infection process.^[52]

Attor's installer plugin can schedule rundll32.exe to load the dispatcher.^[36]

Bisonal uses rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\"vert" = "rundll32.exe c:\windows\temp\pvcu.dll , Qszdez".^[5]

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.^[50]

Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.^[8]

Carbanak installs VNC server software that executes through rundll32.^[47]

Comnie uses Rundll32 to load a malicious DLL.^[16]

CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.^[39]

CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."^[31]

The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.^[29]

DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.^[4]

After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.^[15]

Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.^[18]

FELIXROOT uses Rundll32 for executing the dropper program.^[19][20]

Rundll32.exe is used as a way of executing Flame at the command-line.^[12]

A gh0st RAT variant has used rundll32 for execution.^[30]

GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).^[20]

JHUHUGIT is executed using rundll32.exe.^[13][14]

Koadic can use Rundll32 to execute additional payloads.^[3]

KONNI has used Rundll32 to execute its loader for privilege escalation purposes.^[35]

Kwampirs uses rundll32.exe in a Registry value added to establish persistence.^[28]

Matroyshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.^[6]

Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.^[27]

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.^[46]

NOKKI has used rundll32 for execution.^[22]

NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.^[32]

PowerDuke uses rundll32.exe to load.^[21]

Prikormka uses rundll32.exe to load its DLL.^[26]

Pteranodon executes functions using rundll32.exe.^[7]

PUNCHBUGGY can load a DLL using Rundll32.^[9]

Ragnar Locker has used rundll32.exe to execute components of VirtualBox.^[38]

RTM runs its core DLL file using rundll32.exe.^[24][25]

Sakula calls cmd.exe to run various DLL files via rundll32.^[10]

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.^[51]

ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.^[33]

StreamEx uses rundll32 to call an exported function.^[11]

TA505 has leveraged rundll32.exe to execute malicious DLLs.^[49][33]

USBferry can execute rundll32.exe in memory to avoid detection.^[37]

The Winnti for Windows installer loads a DLL using rundll32.^[17]

ZxShell has used rundll32.exe to execute other DLLs and named pipes.^[34]

Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using rundll32.exe to bypass application control.