Qilin Ransomware - Analyzing the EDR Killer Infection Chain
Basically, Qilin ransomware uses a tricky file to disable security tools on computers.
A new analysis reveals the malicious 'msimg32.dll' used in Qilin ransomware attacks targeting EDR systems. This sophisticated malware can disable over 300 EDR solutions, posing a significant risk. Understanding its mechanisms is crucial for cybersecurity defenses.
What Happened
The Qilin ransomware has introduced a sophisticated malware component known as msimg32.dll, which is part of a multi-stage infection chain specifically designed to disable Endpoint Detection and Response (EDR) systems. This malicious DLL can terminate over 300 different EDR drivers from various vendors, making it a significant threat to cybersecurity.
How It Works
The infection begins with a PE loader that prepares the environment for the EDR killer component. This loader executes advanced evasion techniques, such as neutralizing user-mode hooks and suppressing Event Tracing for Windows (ETW) event generation. By leveraging Structured Exception Handling (SEH) and Vectored Exception Handling (VEH), the malware can obscure its control flow and conceal its API invocation patterns. This allows the EDR killer to operate undetected in memory.
Once activated, the EDR killer loads two helper drivers:
- rwdrv.sys: Provides access to the system's physical memory.
- hlpdrv.sys: Terminates EDR processes.
Prior to loading these drivers, the EDR killer unregisters monitoring callbacks set by the EDR, ensuring that the termination process goes uninterrupted.
Who's Being Targeted
The Qilin ransomware targets organizations that rely on EDR systems for cybersecurity. As EDR tools become more common, attackers are increasingly focusing on disabling these defenses to gain a foothold in compromised systems.
Signs of Infection
Organizations should be vigilant for signs of infection, including:
- Unexplained system slowdowns.
- Unusual network activity or unexpected process terminations.
- Alerts from EDR solutions that may indicate attempts to disable them.
Defensive Measures
To protect against this sophisticated malware, organizations should:
- Regularly update and patch EDR solutions to defend against known vulnerabilities.
- Implement multi-layered security strategies that include behavioral detection and incident response plans.
- Monitor for unusual system behavior and conduct regular security audits.
Conclusion
The Qilin ransomware's use of msimg32.dll represents a significant evolution in malware tactics, targeting the very defenses meant to protect systems. Understanding how this infection chain operates is crucial for developing effective countermeasures against such sophisticated threats.