Follow 
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
Threat actors are increasingly relying on ClickFix and TerminalFix techniques to deliver malware loaders, including Lorem Ipsum Loader and Axolotl Loader. These loaders often serve as precursors to ransomware deployment through DLL sideloading, MSI installers, and Node.js execution. The campaigns also incorporate advanced evasion techniques such as ntdll unhooking and encrypted payloads embedded within custom DLL sections.
Investigation
Researchers analyzed Lorem Ipsum and Axolotl Loader samples to examine their delivery chains and technical characteristics. The investigation uncovered trojanized MSI installers, multi-stage PowerShell scripts, and a distinctive .cpoc section within DLLs used for resource storage. Comparative analysis also revealed differences in C2 communication, evasion mechanisms, and persistence techniques across the two loader families.
Mitigation
Organizations should monitor Sysmon telemetry for DLL sideloading and suspicious parent-child process relationships, including PowerShell launching batch files. Enforcing strict controls over MSI installer execution and detecting unsigned DLLs in user-writable directories is recommended. Security teams should also inspect network traffic for unusual User-Agents, such as Firefox/143, and suspicious C2 registration patterns associated with active infections.
Response
When malicious activity is detected, isolate affected hosts and perform forensic analysis of user-writable directories such as C:\Windows\Temp or C:\Users\Public. Hunt for scheduled tasks and Registry Run keys using randomized names. Conduct retrospective searches across DNS and proxy logs for known C2 domains and IP addresses to determine the scope of compromise.
Attack Flow
We are still updating this part.
Detections
Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via registry_event)
Possible Execution by Use of Short Script Name (via cmdline)
Schtasks Points to Suspicious Directory / Binary / Script (via cmdline)
Suspicious Powershell Strings (via powershell)
Call Suspicious Windows API Functions from Powershell (via powershell)
Suspicious Files in Public User Profile (via file_event)
Suspicious Scheduled Task (via audit)
IOCs (HashSha256) to detect: From ClickFix to C2: Comparative Analysis of Two Malware Loaders Part 2
IOCs (HashSha256) to detect: From ClickFix to C2: Comparative Analysis of Two Malware Loaders Part 1
IOCs (HashMd5) to detect: From ClickFix to C2: Comparative Analysis of Two Malware Loaders
IOCs (SourceIP) to detect: From ClickFix to C2: Comparative Analysis of Two Malware Loaders
IOCs (DestinationIP) to detect: From ClickFix to C2: Comparative Analysis of Two Malware Loaders
Sideload Host Relaunch By Itself With UUID Named Mutex [Windows Process Creation]
Detection of Malicious Requests and Command and Control Patterns with letsdiskuss.com [Windows Network Connection]
DLL Sideloading and Registry Run Key Persistence via Signed Microsoft Executables [Windows Sysmon]
Detection of Malicious PowerShell and DLL Activity [Windows Powershell]
Simulation Execution
-
Attack Narrative & Commands: An adversary has gained initial access and is attempting to deploy a modular malware loader. To evade simple signature-based AV, they use PowerShell to call a custom loader. The loader utilizes specific runtime libraries (
libgcc_s_seh-1.dll) and requires specific flags (-AgentDll) to initialize the payload in memory. The attacker’s goal is to establish a persistent C2 connection by loading these components through a PowerShell-driven execution chain. -
Regression Test Script:
# Simulation Script for Detection Validation # This script mimics the behavior defined in the Sigma rule $workingDir = $env:TEMP $dllName = "libgcc_s_seh-1.dll" $dllPath = Join-Path $workingDir $dllName Write-Host "[+] Creating dummy DLL for simulation..." New-Item -Path $dllPath -ItemType File -Force | Out-Null Write-Host "[+] Executing PowerShell command to trigger selection1 (DLL name in command line)..." Start-Process powershell.exe -ArgumentList "-Command `& {Write-Output 'Loading $dllPath'}`" -NoNewWindow Write-Host "[+] Executing PowerShell command to trigger selection2 (AgentDll flag)..." Start-Process powershell.exe -ArgumentList "-AgentDll -DepsDir C:Temp -Shim" -NoNewWindow Write-Host "[+] Simulation Complete." -
Cleanup Commands:
# Cleanup Script $workingDir = $env:TEMP $dllName = "libgcc_s_seh-1.dll" $dllPath = Join-Path $workingDir $dllName if (Test-Path $dllPath) { Remove-Item -Path $dllPath -Force Write-Host "[+] Cleaned up dummy DLL." } else { Write-Host "[!] DLL not found, nothing to clean." }
