Qilin EDR Killer Infection Chain

Summary

The report covers a multi-stage loader delivered as a trojanized msimg32.dll that can disable or remove 300+ endpoint detection and response products. The loader combines advanced SEH/VEH abuse, kernel-driver techniques, and hardware breakpoints to evade user-mode hooks and kill security processes. The activity is linked to the Qilin ransomware ecosystem and ships with a custom driver derived from ThrottleStop tooling. The end result is a dedicated EDR-killer payload that terminates security services and can re-enable attacker control by restoring or neutralizing code-integrity callback logic.

Investigation

Researchers reverse-engineered the malicious DLL, its PE loader, and two helper drivers, rwdrv.sys and hlpdrv.sys. The analysis details how the loader builds a syscall slot-policy table, tampers with the exception dispatcher, and performs IAT hooking to redirect execution. It then uses vectored exception handling to stage and launch a shell32-based payload. The driver layer exposes raw physical memory access and is leveraged to remove or disable EDR-related kernel callbacks, as well as terminate protected processes via a custom IOCTL interface.

Mitigation

Use layered defenses and avoid dependence on a single EDR control. Monitor for abnormal driver-load activity, suspicious physical-memory IOCTL usage, and unexpected changes to kernel callback structures. Prevent DLL side-loading where attackers replace legitimate system libraries, and add coverage for hardware-breakpoint style evasion. Keep network and endpoint signatures current, including rulesets from tools such as ClamAV and Snort.

Response

If detected, isolate the endpoint, stop the malicious process, and unload any suspicious drivers. Capture full memory images for forensics, check explicitly for rwdrv.sys and hlpdrv.sys, and validate integrity of kernel callbacks and related security telemetry. Deploy updated detections for the msimg32.dll filename, driver load events, and the IOCTL 0x2222008 pattern. Complete a system integrity review and recover from known-good backups if trust in the host cannot be re-established.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An attacker crafts a minimal native C binary that explicitly loads ntdll.dll and calls NtTraceEvent via its exported name. The binary is compiled on‑the‑target host using the Visual C++ Build Tools, then executed. Because the call is made through the regular Windows API surface, the process creation event records the image (ntdll.dll) and the CallTrace field contains the string “NtTraceEvent”, satisfying the Sigma condition. The attacker then deletes the binary to reduce forensic artifacts.

• Regression Test Script:

  # ---------------------------------------------------------
  # Step 1 – Create a temporary C source that calls NtTraceEvent
  # ---------------------------------------------------------
  $src = @"
  #include <windows.h>
  typedef NTSTATUS (NTAPI *pNtTraceEvent)(HANDLE, ULONG, PVOID, ULONG);
  int main() {
      HMODULE hNtdll = LoadLibraryA("ntdll.dll");
      if (!hNtdll) return 1;
      pNtTraceEvent NtTraceEvent = (pNtTraceEvent)GetProcAddress(hNtdll, "NtTraceEvent");
      if (!NtTraceEvent) return 1;
      // Minimal call – arguments are largely ignored for this demo
      NtTraceEvent(NULL, 0, NULL, 0);
      return 0;
  }
  "@
  $tmpPath = "$env:TEMPNtTraceDemo.c"
  $exePath = "$env:TEMPNtTraceDemo.exe"
  $src | Set-Content -Path $tmpPath -Encoding ASCII
  
  # ---------------------------------------------------------
  # Step 2 – Compile using cl.exe (assumes Visual C++ Build Tools installed)
  # ---------------------------------------------------------
  $vcVars = "$env:ProgramFiles(x86)Microsoft Visual Studio2019BuildToolsVCAuxiliaryBuildvcvars64.bat"
  if (Test-Path $vcVars) {
      & cmd /c "`"$vcVars`" && cl /nologo /O2 /Fe:`"$exePath`" `"$tmpPath`""
  } else {
      Write-Error "Visual C++ Build Tools not found. Install them before running this script."
      exit 1
  }
  
  # ---------------------------------------------------------
  # Step 3 – Execute the binary (this should trigger the rule)
  # ---------------------------------------------------------
  & $exePath
  
  # ---------------------------------------------------------
  # Step 4 – Clean up artifacts
  # ---------------------------------------------------------
  Remove-Item -Force $tmpPath, $exePath

• Cleanup Commands:

  # Ensure any leftover files are removed (run as admin)
  Get-ChildItem "$env:TEMPNtTraceDemo.*" -ErrorAction SilentlyContinue | Remove-Item -Force