Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: APT28 executed CHOPSTICK by using rundll32 commands such as <code>rundll32.exe “C:\Windows\twain_64.dll”</code>. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.