RenEngine Loader and HijackLoader: Dual-Stage Attack Chain Fueling Stealer Campaigns

Summary

Since April 2025, researchers have tracked a large-scale stealer operation built around a two-stage loader chain. The first stage, RenEngine Loader, is embedded inside an otherwise legitimate Ren’Py game launcher and decrypts a follow-on loader dubbed HijackLoader. HijackLoader then abuses DLL side-loading and process doppelgänging, using a modular framework that can stage 30+ helper modules before ultimately delivering an ACR stealer payload. Distribution is tied to cracked game installers promoted through piracy ecosystems, with the activity impacting hundreds of thousands of victims globally.

Investigation

The Howler Cell team reconstructed the full execution chain, reverse-engineering the RenEngine Python logic, extracting configuration artifacts, and identifying an XOR-encrypted archive used for staging. Their analysis of HijackLoader cataloged 38 modules, including anti-VM checks, UAC bypass, scheduled-task persistence, and reverse-shell capabilities. Infrastructure analysis linked the campaign to a single public C2 endpoint, 78.40.193.126, and the delivery domain dodi-repacks.site, which was used to seed the initial installer downloads.

Mitigation

Monitor for anomalous Ren’Py launcher executions, especially when paired with DLL side-loading of common filenames such as d3dx9_43.dll. Hunt for suspicious directory creation under %ProgramData% and %AppData%, particularly paths named broker_crypt_v4_i386. Add behavioral detections for sandbox-evasion routines, process doppelgänging, and unusual registry access patterns associated with virtual-machine artifact checks. Block known piracy distribution domains at the web gateway, and apply application allow-listing to restrict game launchers and unsigned “installer” executables from running in user-writable locations.

Response

On detection, isolate the endpoint, preserve evidence (memory dumps, the encrypted archives, and loader artifacts), and sweep the environment for the identified modules and dropped files. Immediately block 78.40.193.126 and dodi-repacks.site at perimeter controls. Perform credential-exposure triage focused on browser passwords, session cookies, and cryptocurrency wallets, then rotate impacted accounts and tokens. Remove attacker persistence (notably scheduled tasks) and purge malicious files, then continue monitoring for reinfection paths tied to pirated software installs.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker obtains a malicious Ren’Py game installer (Installer.exe) that has been repackaged to include a hidden Python payload. When the victim runs the installer, it spawns a secondary loader (W8CPbGQI.exe). That loader unpacks a third-stage binary (ZoneInd.exe) which performs process injection, credential dumping, and establishes a C2 channel over HTTP. The attacker deliberately avoids naming any child process chime.exe to satisfy the rule’s exclusion clause.

  Steps performed on the compromised host:

  1. Launch the compromised Ren’Py installer.
     Installer.exe runs as the parent process.
  2. Spawn the first malicious loader.
     Installer.exe creates W8CPbGQI.exe (Process Creation event – matches TargetImage).
  3. Spawn the second-stage payload.
     W8CPbGQI.exe launches ZoneInd.exe (another Process Creation event – also matches TargetImage).
  4. Perform malicious actions (process injection, credential dumping, C2).

  These actions generate the exact telemetry that the Sigma rule monitors: a process with Image=*\Installer.exe creating a child with TargetImage=*\W8CPbGQI.exe or *\ZoneInd.exe, without the exclusion *\chime.exe.

• Regression Test Script:
  The script below creates dummy executable files (simple PowerShell scripts saved as .exe via powershell -c "..." for demonstration) and then orchestrates the chain. Run it in an elevated PowerShell prompt.

  # -------------------------------------------------
  # Regression Test Script – Simulate Malicious Chain
  # -------------------------------------------------
  
  # 1. Create placeholder binaries (simulated executables)
  $binPath = "$env:TEMPRenPyChain"
  New-Item -ItemType Directory -Path $binPath -Force | Out-Null
  
  # Helper to create a lightweight exe that simply sleeps (use PowerShell's .exe shim)
  function New-StubExe($name) {
      $script = "Start-Sleep -Seconds 30"
      $ps1 = "$binPath$name.ps1"
      $exe = "$binPath$name.exe"
      Set-Content -Path $ps1 -Value $script -Encoding UTF8
      # Use PowerShell's built‑in PS2EXE (or any exe wrapper) – here we mimic with PowerShell -File
      # For simplicity, we just create a scheduled task that runs the ps1; the .exe path is a placeholder.
      New-Item -ItemType File -Path $exe -Force | Out-Null
  }
  
  # Create stub executables
  New-StubExe "Installer"
  New-StubExe "W8CPbGQI"
  New-StubExe "ZoneInd"
  
  # 2. Execute the chain
  Write-Host "`n[+] Launching Installer.exe (parent)..."
  Start-Process -FilePath "$binPathInstaller.exe" -NoNewWindow
  
  # Small delay to ensure parent process appears in logs
  Start-Sleep -Seconds 2
  
  Write-Host "[+] Installer.exe spawning W8CPbGQI.exe..."
  Start-Process -FilePath "$binPathW8CPbGQI.exe" -NoNewWindow
  
  Start-Sleep -Seconds 1
  
  Write-Host "[+] W8CPbGQI.exe spawning ZoneInd.exe..."
  Start-Process -FilePath "$binPathZoneInd.exe" -NoNewWindow
  
  Write-Host "`n[+] Chain executed. Verify detection in your SIEM."
  # -------------------------------------------------

• Cleanup Commands:
  Remove the temporary files and terminate any lingering sleep processes.

  # Cleanup the stub executables and directory
  $binPath = "$env:TEMPRenPyChain"
  Write-Host "`n[+] Stopping any lingering stub processes..."
  Get-Process -Name "Installer","W8CPbGQI","ZoneInd" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  Write-Host "[+] Removing temporary files..."
  Remove-Item -Path $binPath -Recurse -Force
  
  Write-Host "[+] Cleanup complete."