Technique:  System Binary Proxy Execution:Rundll32
During the 2015 Ukraine Electric Power Attack, It used a backdoor which could execute a supplied DLL using rundll32.exe.
ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.
It configured its payload to inject into the rundll32.exe.
It executed CHOPSTICK by using rundll32 commands such as rundll32.exe "C:\Windows\twain_64.dll". It also executed a .dll for a first stage dropper using rundll32.exe. An It loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.
It has a tool that can run DLLs.
It malware has used rundll32.exe to execute an initial infection process.
It has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.
It has used rundll32.exe to execute a loader.
Attor's installer plugin can schedule rundll32.exe to load the dispatcher.
Backdoor.Oldrea can use rundll32 for execution on compromised hosts.
Bad Rabbit has used rundll32 to launch a malicious DLL as C:Windowsinfpub.dat.
Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\"vert" = "rundll32.exe c:\windows\temp\pvcu.dll , Qszdez".
BLINDINGCAN has used Rundll32 to load a malicious DLL.
It has executed custom-compiled XMRIG miner DLLs using rundll32.exe.
BoomBox can use RunDLL32 for execution.
Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.
Bumblebee has used rundll32 for execution of the loader component.
During C0015, the threat actors loaded DLLs via rundll32 using the svchost process.
During C0018, the threat actors used rundll32 to run Mimikatz.
During C0021, the threat actors used rundll32.exe to execute the Cobalt Strike Beacon loader DLL.
It installs VNC server software that executes through rundll32.
Cobalt Strike can use rundll32.exe to load DLL from the command line.
Comnie uses Rundll32 to load a malicious DLL.
It uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.
CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."
The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.
DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.
DEADEYE can use rundll32.exe for execution of living off the land binaries (lolbin) such as SHELL32.DLL.
Egregor has used rundll32 during execution.
After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.
Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.
EnvyScout has the ability to proxy execution of malicious files with Rundll32.
EVILNUM can execute commands and scripts through rundll32.
FatDuke can execute via rundll32.
FELIXROOT uses Rundll32 for executing the dropper program.
It has used rundll32.exe to execute malware on a compromised network.
Rundll32.exe is used as a way of executing Flame at the command-line.
FlawedAmmyy has used rundll32 for execution.
FunnyDream can use rundll32 for execution of its components.
It malware has used rundll32 to launch additional malicious components.
A gh0st RAT variant has used rundll32 for execution.
GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).
It has used rundll32 to load malicious DLLs.
HermeticWizard has the ability to create a new process using rundll32.
Heyoka Backdoor can use rundll32.exe to gain execution.
InvisiMole has used rundll32.exe for execution.
JHUHUGIT is executed using rundll32.exe.
It has used rundll32.exe to execute malicious scripts and malware on a victim's network.
Koadic can use Rundll32 to execute additional payloads.
KONNI has used Rundll32 to execute its loader for privilege escalation purposes.
Kwampirs uses rundll32.exe in a Registry value added to establish persistence.
It has used rundll32 to execute malicious payloads on a compromised host.
It has used rundll32.exe to execute Koadic stagers.
It has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.
Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.
MegaCortex has used rundll32.exe to load a DLL for file encryption.
Mongall can use rundll32.exe for execution.
Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.
It has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.
NativeZone has used rundll32 to execute a malicious DLL.
NOKKI has used rundll32 for execution.
NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.
During Operation Dream Job, It executed malware with C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db", CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905.
During Operation Spalax, the threat actors used rundll32.exe to execute malicious installers.
PcShare has used rundll32.exe for execution.
PolyglotDuke can be executed using rundll32.exe.
PowerDuke uses rundll32.exe to load.
Prikormka uses rundll32.exe to load its DLL.
Pteranodon executes functions using rundll32.exe.
PUNCHBUGGY can load a DLL using Rundll32.
QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.
Ragnar Locker has used rundll32.exe to execute components of VirtualBox.
It runs its core DLL file using rundll32.exe.
Sakula calls cmd.exe to run various DLL files via rundll32.
It used a backdoor which could execute a supplied DLL using rundll32.exe.
SDBbot has used rundll32.exe to execute DLLs.
ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.
Sibot has executed downloaded DLLs with rundll32.exe.
During the SolarWinds Compromise, It used Rundll32.exe to execute payloads.
Squirrelwaffle has been executed using rundll32.exe.
StreamEx uses rundll32 to call an exported function.
SUNBURST used Rundll32 to execute payloads.
SVCReady has used rundll32.exe for execution.
It has leveraged rundll32.exe to execute malicious DLLs.
It has used rundll32.exe to load malicious DLLs.
USBferry can execute rundll32.exe in memory to avoid detection.
The Winnti for Windows installer loads a DLL using rundll32.
It has utilized rundll32.exe to deploy ransomware commands with the use of WebDAV.
ZxShell has used rundll32.exe to execute other DLLs and named pipes.