Qilin Ransomware Evades EDR Solutions With Malicious DLL

Key Takeaways

• The Qilin ransomware group is employing a sophisticated, multi-stage attack that effectively bypasses numerous Endpoint Detection and Response (EDR) solutions.
• The attack chain leverages a malicious msimg32.dll to disable over 300 EDR drivers from major security vendors, severely hindering detection capabilities.
• Qilin, also known as Agenda, Gold Feather, and Water Galura, is a highly active Ransomware-as-a-Service (RaaS) operation, claiming over 40 victims monthly.
• The threat actors utilize advanced anti-detection techniques, including DLL sideloading, kernel object manipulation, and syscall bypasses, to operate undetected before deploying their ransomware payload.

Qilin Ransomware Bypasses EDR Solutions with Advanced DLL Sideloading and Kernel Manipulation

The Qilin ransomware collective has developed a highly advanced, multi-stage infection process designed to circumvent a wide array of Endpoint Detection and Response (EDR) security products. This sophisticated attack vector integrates a malicious msimg32.dll file to neutralize more than 300 EDR drivers from nearly every prominent security vendor.

As enterprises increasingly depend on EDR systems for their enhanced behavioral visibility over traditional antivirus, threat actors have adapted their strategies. They now routinely incorporate EDR-disabling tools as a fundamental element of their attack methodology.

By effectively shutting down telemetry collection related to process creation, memory operations, and network activity, attackers can maintain stealth for a sufficient period to deploy their ransomware payload without triggering alerts.

Qilin, also identified by researchers as Agenda, Gold Feather, and Water Galura, operates as one of the most prolific Ransomware-as-a-Service (RaaS) operations, reportedly victimizing over 40 organizations each month.

DLL Sideloading Initiates the Attack Chain

Investigations by Cisco Talos reveal that the initial compromise begins with DLL sideloading. A legitimate application, such as FoxitPDFReader.exe, is tricked into loading a malicious msimg32.dll instead of the authentic Windows library.

To avoid immediate suspicion, this rogue DLL intelligently forwards all expected API calls to the legitimate C:WindowsSystem32msimg32.dll, thereby preserving the application’s normal functionality. Simultaneously, its malicious code is triggered directly from the DllMain function.

The DLL contains an encrypted EDR killer payload that undergoes three distinct loading stages. The final component is executed entirely in memory, ensuring that its decrypted form never touches the disk, a tactic designed to evade detection.

The loader incorporates a series of advanced anti-detection techniques specifically engineered to blind EDR products before they can generate an alert:

• SEH/VEH-based control flow obfuscation: Structured Exception Handling (SEH) and Vectored Exception Handling (VEH) are weaponized to obscure API invocation patterns and covertly transfer execution between different stages of the malware.
• ETW suppression: Event Tracing for Windows (ETW) is neutralized during runtime, effectively depriving security defenders of critical telemetry data necessary for behavioral detection.
• Halo’s Gate syscall bypass: The loader meticulously scans ntdll.dll in both forward and backward directions to locate clean, unhooked neighboring syscall stubs. It then re-purposes these stubs to invoke desired system calls, bypassing EDR-hooked APIs without modifying any existing hooked code.
• Kernel object manipulation: The loader directly overwrites the .mrdata section of ntdll.dll, which contains the exception dispatcher callback pointer. This manipulation redirects exception handling to the malware’s own custom routine.
• Anti-debugging measures: The malware actively checks for breakpoints on KiUserExceptionDispatcher and intentionally crashes the process if any are detected, complicating analysis.

Furthermore, the loader implements geo-fencing, terminating its execution if the system’s locale matches a post-Soviet country. This specific exclusion list mirrors patterns observed in other Russian-affiliated ransomware operations.

The EDR Killer’s Modus Operandi

Upon successful delivery of its final payload (Stage 4) by the multi-stage loader, the EDR killer Portable Executable (PE) loads two kernel-level helper drivers:

• rwdrv.sys: This is a renamed version of ThrottleStop.sys, a driver legitimately signed by TechPowerUp LLC and commonly found in tools like GPU-Z. Despite its benign origin, this driver exposes powerful Input/Output Control Codes (IOCTLs) for physical memory read/write, MSR access, and PCI configuration. The malware exploits these capabilities to directly manipulate kernel structures, bypassing protected virtual memory mechanisms.
• hlpdrv.sys: This driver is exclusively utilized to terminate protected EDR processes through a specific IOCTL code (0x2222008), thereby circumventing Windows’ native process protection mechanisms.

The EDR killer then iterates through a hardcoded list containing over 300 EDR driver names. Using physical memory writes via rwdrv.sys, it unregisters monitoring callbacks for critical events such as process creation, thread creation, and image loading. This action effectively disables EDR visibility at the kernel level.

A particularly notable tactic involves the malware temporarily overwriting the CiValidateImageHeader callback with a function that consistently returns true. This maneuver temporarily disables Code Integrity enforcement during the attack, only to restore it afterward to minimize forensic traces.

While Cisco Talos acknowledges that these techniques are not entirely novel, they remain highly effective. The researchers emphasize that such attacks should still be detectable by properly configured, multi-layered defense stacks.

This campaign underscores that targeting and neutralizing the defense layer itself, prior to the deployment of ransomware, has become a standard operational phase for sophisticated ransomware groups like Qilin.

What You Should Do

• Monitor for DLL Sideloading: Implement robust monitoring for suspicious DLL sideloading activities, especially involving critical system DLLs like msimg32.dll, even if the primary application appears to function normally.
• Inspect Driver Installations: Actively monitor for the installation of unexpected or unapproved drivers, particularly those named rwdrv.sys and hlpdrv.sys, or other drivers with unusual origins.
• Detect Physical Memory Writes: Configure security solutions to alert on any attempts by user-mode processes to perform direct writes to physical memory. This behavior is highly suspicious and often indicative of kernel-level manipulation.
• Adopt a Multi-Layered Defense: Do not rely on a single security product. Implement a defense-in-depth strategy that includes EDR, network segmentation, application whitelisting, and strong identity and access management.
• Regularly Patch and Update: Ensure all operating systems, applications, and security software are kept up-to-date with the latest patches to mitigate known vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.