{
  "family": "dllhijacker",
  "sample_count": 7,
  "category": "ransomware",
  "description": "Trojan:Win32/Dllhijacker is a generic heuristic detection used by antivirus engines to classify malware that specifically relies on **DLL Search Order Hijacking** (`T1574.001`) to execute its payload. This is a highly advanced evasion and privilege escalation technique where malware replaces a legitimate, expected Dynamic Link Library (DLL) with a malicious fake, tricking a trusted system process into loading the malware into its own memory space.<br><br><b>Understanding DLL Hijacking</b><br>To an end-user, this attack is completely invisible. For a security analyst, a Dllhijacker detection indicates a sophisticated adversary attempting to bypass application whitelisting (like AppLocker) and evade EDR by hiding within the context of a trusted Microsoft process. APT groups and advanced ransomware families frequently utilize this technique for stealthy persistence.<br><br><b>Execution and Hijacking Mechanics</b><br>When a Windows application starts, it often doesn't specify the exact, absolute path to the DLLs it needs. Instead, it relies on the Windows DLL Search Order (checking the application directory first, then `System32`, then the PATH). The malware exploits this by dropping a malicious DLL, named identically to a legitimate missing DLL, into a directory higher up in the search order (often the application's own directory) (`T1574.001`). When the legitimate executable runs (`T1204.002`), it inadvertently loads the malicious DLL (`T1055.001`). The malicious DLL executes its payload (often a beacon or downloader), and then uses API forwarding to seamlessly pass the legitimate function calls back to the real DLL, ensuring the parent application doesn't crash and the user notices nothing.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is stealthy, persistent execution of malware disguised as trusted processes. The primary IoC is EDR alerts detecting unsigned DLLs being loaded by signed, native Windows executables (e.g., `calc.exe` or `msteams.exe` loading a malicious `version.dll` from the `%AppData%` directory). Threat hunters should look for newly created `.dll` files in unexpected directories alongside legitimate executables.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1574.001",
    "T1547",
    "T1055.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1574.001",
      "name": "Hijack Execution Flow: Search Order Hijacking",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547",
      "name": "Boot or Logon Autostart Execution (Using hijacked DLLs for persistence)",
      "tactic": "Persistence"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint. Because the malware is running inside a legitimate process, simply killing the process may crash the system or the application will just restart and re-load the malicious DLL.",
    "Utilize EDR to identify the specific signed executable that was exploited and the exact path of the malicious, unsigned DLL it loaded.",
    "Delete the malicious DLL from the file system. Ensure the legitimate application is reinstalled or repaired if necessary.",
    "Audit the system for any secondary payloads downloaded by the hijacked process."
  ],
  "what_to_avoid": [
    "Do not blindly trust an executable just because it is digitally signed by Microsoft; if it is vulnerable to DLL hijacking, it can be weaponized.",
    "Avoid assuming standard AV will catch this; if the malicious DLL is well-obfuscated, the AV will only see a trusted process running."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}