value:  Attor's installer plugin can schedule rundll32.exe to load the dispatcher. ;; Bisonal uses rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll  Qszdez”. ;; BLINDINGCAN has used Rundll32 to load a malicious DLL. ;; Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe. ;; Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs. ;; Carbanak installs VNC server software that executes through rundll32. ;; Comnie uses Rundll32 to load a malicious DLL. ;; CopyKittens uses rundll32 to load various tools on victims including a lateral movement tool named Vminst Cobalt Strike and shellcode. ;; CORESHELL is installed via execution of rundll32 with an export named init" or "InitW." ;; The CozyCar dropper copies the system file rundll32.exe to the install location for the malware then uses the copy of rundll32.exe to load and execute the main CozyCar component. ;; DDKONG uses Rundll32 to ensure only a single instance of itself is running at once. ;; Egregor has used rundll32 during execution. ;; After copying itself to a DLL file a variant of Elise calls the DLL file using rundll32.exe. ;; Variants of Emissary have used rundll32.exe in Registry values added to establish persistence. ;; EVILNUM can execute commands and scripts through rundll32. ;; FatDuke can execute via rundll32. ;; FELIXROOT uses Rundll32 for executing the dropper program. ;; Rundll32.exe is used as a way of executing Flame at the command-line. ;; Gamaredon Group malware has used rundll32 to launch additional malicious components. ;; A gh0st RAT variant has used rundll32 for execution. ;; GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM). ;; HAFNIUM has used rundll32 to load malicious DLLs. ;; InvisiMole has used rundll32.exe for execution. ;; JHUHUGIT is executed using rundll32.exe. ;; Koadic can use Rundll32 to execute additional payloads. ;; KONNI has used Rundll32 to execute its loader for privilege escalation purposes. ;; Kwampirs uses rundll32.exe in a Registry value added to establish persistence. ;; Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism. ;; MegaCortex has used rundll32.exe to load a DLL for file encryption. ;; Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability. ;; MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll. ;; NOKKI has used rundll32 for execution. ;; NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic. ;; PolyglotDuke can be executed using rundll32.exe. ;; PowerDuke uses rundll32.exe to load. ;; Prikormka uses rundll32.exe to load its DLL. ;; Pteranodon executes functions using rundll32.exe. ;; PUNCHBUGGY can load a DLL using Rundll32. ;; Ragnar Locker has used rundll32.exe to execute components of VirtualBox. ;; RTM runs its core DLL file using rundll32.exe. ;; Sakula calls cmd.exe to run various DLL files via rundll32. ;; Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe. ;; ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe. ;; Sibot has executed downloaded DLLs with rundll32.exe. ;; StreamEx uses rundll32 to call an exported function. ;; SUNBURST used Rundll32 to execute payloads. ;; TA505 has leveraged rundll32.exe to execute malicious DLLs. ;; TA551 has used rundll32.exe to load malicious DLLs. ;; UNC2452 used Rundll32 to execute payloads. ;; USBferry can execute rundll32.exe in memory to avoid detection. ;; The Winnti for Windows installer loads a DLL using rundll32. ;; ZxShell has used rundll32.exe to execute other DLLs and named pipes. "
name: Signed Binary Proxy Execution: Rundll32