New HijackLoader Version Uses Advanced Threat Evasion
Threat actors capitalize on the potency of HijackLoader as a robust tool for embedding malicious code into legitimate processes, facilitating the discreet execution of payloads. This method enables them to bypass detection by employing trusted applications to carry out harmful actions. This complexity poses challenges for security measures to effectively recognize and counteract the threat.
Recently, cybersecurity researchers at CrowdStrike uncovered a version of HijackLoader (also known as IDAT Loader) employing advanced techniques to elude detection. CrowdStrike researchers identified the evolution of HijackLoader, incorporating new defense evasion strategies such as process hollowing, pipe-triggered activation, and a combination of process doppelganging. These refinements enhance its stealthiness and make it more resistant to analysis, accompanied by the discovery of additional unhooking techniques.
HijackLoader Evades Detection
A sophisticated HijackLoader sample was revealed by CrowdStrike, initiating with streaming_client.exe. This sample obfuscates a configuration to elude static analysis and, using WinHTTP APIs, tests internet connectivity by reaching out to https[:]//nginx[.]org. Upon successful connection, it downloads a second-stage configuration from a remote server.
Upon obtaining the second-stage configuration, the malware searches for PNG header bytes and a magic value, decrypting using XOR and decompressing with the RtlDecompressBuffer API. Subsequently, it loads a legitimate Windows DLL specified in the configuration, writing the shellcode to its .text section for execution. Employing Heaven’s Gate to bypass user mode hooks, the malware injects additional shellcodes into cmd.exe. The third-stage shellcode then injects a final payload, such as a Cobalt Strike beacon, into logagent.exe using process hollowing.
HijackLoader employs various evasion tactics, including Heaven’s Gate hook bypass and unhooking DLLs monitored by security tools. Additionally, it utilizes process hollowing variations and transacted hollowing for injection, making it a formidable challenge for detection.
