APT28 executed CHOPSTICK by using rundll32 commands such as "rundll32.exe “C:\Windows\twain_64.dll”". APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.