C0028 2015 Ukraine Electric Power Attack

During the 2015 Ukraine Electric Power Attack, Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe. [8]

S0045 ADVSTORESHELL

ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.[9]

G0073 APT19

APT19 configured its payload to inject into the rundll32.exe.[10]

G0007 APT28

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe "C:\Windows\twain_64.dll". APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.[11][9][12][13][14][15]

G0022 APT3

APT3 has a tool that can run DLLs.[16]

G0050 APT32

APT32 malware has used rundll32.exe to execute an initial infection process.[17]

G0082 APT38

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.[18][19]

G0096 APT41

APT41 has used rundll32.exe to execute a loader.[20]

G0143 Aquatic Panda

Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.[21]

S0438 Attor

Attor's installer plugin can schedule rundll32.exe to load the dispatcher.[22]

S0093 Backdoor.Oldrea

Backdoor.Oldrea can use rundll32 for execution on compromised hosts.[23]

S0606 Bad Rabbit

Bad Rabbit has used rundll32 to launch a malicious DLL as C:Windowsinfpub.dat.[24]

S0268 Bisonal

Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\"vert" = "rundll32.exe c:\windows\temp\pvcu.dll , Qszdez".[25]

S0520 BLINDINGCAN

BLINDINGCAN has used Rundll32 to load a malicious DLL.[26]

G0108 Blue Mockingbird

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.[27]

S0635 BoomBox

BoomBox can use RunDLL32 for execution.[28]

S0204 Briba

Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.[29]

S1039 Bumblebee

Bumblebee has used rundll32 for execution of the loader component.[30][31]

C0015 C0015

During C0015, the threat actors loaded DLLs via rundll32 using the svchost process.[32]

C0018 C0018

During C0018, the threat actors used rundll32 to run Mimikatz.[33]

C0021 C0021

During C0021, the threat actors used rundll32.exe to execute the Cobalt Strike Beacon loader DLL.[34]

G0008 Carbanak

Carbanak installs VNC server software that executes through rundll32.[35]

S0154 Cobalt Strike

Cobalt Strike can use rundll32.exe to load DLL from the command line.[36][32][37]

S0244 Comnie

Comnie uses Rundll32 to load a malicious DLL.[38]

G0052 CopyKittens

CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.[39]

S0137 CORESHELL

CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."[40]

S0046 CozyCar

The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.[41]

G1034 Daggerfly

Daggerfly proxied execution of malicious DLLs through a renamed rundll32.exe binary.[42]

S0255 DDKONG

DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.[43]

S1052 DEADEYE

DEADEYE can use rundll32.exe for execution of living off the land binaries (lolbin) such as SHELL32.DLL.[44]

S0554 Egregor

Egregor has used rundll32 during execution.[45]

S0081 Elise

After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.[46]

S0082 Emissary

Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.[47]

S0634 EnvyScout

EnvyScout has the ability to proxy execution of malicious files with Rundll32.[28]

S0568 EVILNUM

EVILNUM can execute commands and scripts through rundll32.[48]

S0512 FatDuke

FatDuke can execute via rundll32.[49]

S0267 FELIXROOT

FELIXROOT uses Rundll32 for executing the dropper program.[50][51]

G0046 FIN7

FIN7 has used rundll32.exe to execute malware on a compromised network.[52]

S0143 Flame

Rundll32.exe is used as a way of executing Flame at the command-line.[53]

S0381 FlawedAmmyy

FlawedAmmyy has used rundll32 for execution.[54]

S1044 FunnyDream

FunnyDream can use rundll32 for execution of its components.[55]

G0047 Gamaredon Group

Gamaredon Group malware has used rundll32 to launch additional malicious components.[56]

S0032 gh0st RAT

A gh0st RAT variant has used rundll32 for execution.[57]

S0342 GreyEnergy

GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).[51]

G0125 HAFNIUM

HAFNIUM has used rundll32 to load malicious DLLs.[58]

S0698 HermeticWizard

HermeticWizard has the ability to create a new process using rundll32.[59]

S1027 Heyoka Backdoor

Heyoka Backdoor can use rundll32.exe to gain execution.[60]

S0483 IcedID

IcedID has used rundll32.exe to execute the IcedID loader.[61][62]

S0260 InvisiMole

InvisiMole has used rundll32.exe for execution.[63]

S0044 JHUHUGIT

JHUHUGIT is executed using rundll32.exe.[64][65]

S1190 Kapeka

Kapeka is a Windows DLL file executed via ordinal by rundll32.exe.[66][67]

G0094 Kimsuky

Kimsuky has used rundll32.exe to execute malicious scripts and malware on a victim's network.[68]

S0250 Koadic

Koadic can use Rundll32 to execute additional payloads.[69]

S0356 KONNI

KONNI has used Rundll32 to execute its loader for privilege escalation purposes.[70][71]

S0236 Kwampirs

Kwampirs uses rundll32.exe in a Registry value added to establish persistence.[72]

S1160 Latrodectus

Latrodectus can use rundll32.exe to execute downloaded DLLs.[73][74]

G0032 Lazarus Group

Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.[75]

G0140 LazyScripter

LazyScripter has used rundll32.exe to execute Koadic stagers.[76]

G0059 Magic Hound

Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.[77]

S0167 Matryoshka

Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.[78]

S0576 MegaCortex

MegaCortex has used rundll32.exe to load a DLL for file encryption.[79]

S1122 Mispadu

Mispadu uses RunDLL32 for execution via its injector DLL.[80]

S1026 Mongall

Mongall can use rundll32.exe for execution.[60]

S0256 Mosquito

Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.[81]

G0069 MuddyWater

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.[82]

S0637 NativeZone

NativeZone has used rundll32 to execute a malicious DLL.[83]

S1100 Ninja

Ninja loader components can be executed through rundll32.exe.[84]

S0353 NOKKI

NOKKI has used rundll32 for execution.[85]

S0368 NotPetya

NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.[86]

C0022 Operation Dream Job

During Operation Dream Job, Lazarus Group executed malware with C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db", CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905.[87][88][89]

C0005 Operation Spalax

During Operation Spalax, the threat actors used rundll32.exe to execute malicious installers.[90]

S1050 PcShare

PcShare has used rundll32.exe for execution.[55]

S0518 PolyglotDuke

PolyglotDuke can be executed using rundll32.exe.[49]

S0139 PowerDuke

PowerDuke uses rundll32.exe to load.[91]

S0113 Prikormka

Prikormka uses rundll32.exe to load its DLL.[92]

S0147 Pteranodon

Pteranodon executes functions using rundll32.exe.[93]

S0196 PUNCHBUGGY

PUNCHBUGGY can load a DLL using Rundll32.[94]

S0650 QakBot

QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.[95][96][97][98][37]

S0481 Ragnar Locker

Ragnar Locker has used rundll32.exe to execute components of VirtualBox.[99]

S1130 Raspberry Robin

Raspberry Robin uses rundll32 execution without any command line parameters to contact command and control infrastructure, such as IP addresses associated with Tor nodes.[100]

G1039 RedCurl

RedCurl has used rundll32.exe to execute malicious files.[101][102][103]

S0148 RTM

RTM runs its core DLL file using rundll32.exe.[104][105]

S0074 Sakula

Sakula calls cmd.exe to run various DLL files via rundll32.[106]

G0034 Sandworm Team

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.[107]

S0461 SDBbot

SDBbot has used rundll32.exe to execute DLLs.[54]

S0382 ServHelper

ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.[108]

S0589 Sibot

Sibot has executed downloaded DLLs with rundll32.exe.[109]

C0024 SolarWinds Compromise

During the SolarWinds Compromise, APT29 used Rundll32.exe to execute payloads.[110][111]

S1030 Squirrelwaffle

Squirrelwaffle has been executed using rundll32.exe.[112][113]

G1053 Storm-0501

Storm-0501 has launched Cobalt Strike Beacon files with rundll32.exe.[114]

S0142 StreamEx

StreamEx uses rundll32 to call an exported function.[115]

S1183 StrelaStealer

StrelaStealer DLL payloads have been executed via rundll32.exe.[116][117]

S0559 SUNBURST

SUNBURST used Rundll32 to execute payloads.[111]

S1064 SVCReady

SVCReady has used rundll32.exe for execution.[118]

G0092 TA505

TA505 has leveraged rundll32.exe to execute malicious DLLs.[119][108]

G0127 TA551

TA551 has used rundll32.exe to load malicious DLLs.[120]

S1196 Troll Stealer

Troll Stealer is dropped as a DLL file and executed via rundll32.exe by its installer.[121][122]

G1048 UNC3886

UNC3886 has used rundll32.exe to execute MiniDump for dumping LSASS process memory.[123]

S0452 USBferry

USBferry can execute rundll32.exe in memory to avoid detection.[124]

C0037 Water Curupira Pikabot Distribution

Water Curupira Pikabot Distribution utilizes rundll32.exe to execute the final Pikabot payload, using the named exports Crash or Limit depending on the variant.[125]

S0141 Winnti for Windows

The Winnti for Windows installer loads a DLL using rundll32.[126][127]

G0102 Wizard Spider

Wizard Spider has utilized rundll32.exe to deploy ransomware commands with the use of WebDAV.[128]

S0412 ZxShell

ZxShell has used rundll32.exe to execute other DLLs and named pipes.[129]