Cisco Talos analyzed a malicious mechanism based on msimg32.dll used in ransomware attacks by Qilin and capable of disabling up to 300 Endpoint Detection and Response (EDR) solutions. The technique is part of a multistage infection chain designed to neutralize defenses before the attack progresses.
The first stage is a PE loader that prepares the environment and decrypts a secondary payload entirely in memory, reducing visibility for local tools. It then activates two auxiliary drivers: rwdrv.sys, for accessing physical system memory, and hlpdrv.sys, for terminating security processes.
The analysis also describes advanced evasion techniques such as structured and vectorized exception handling (SEH/VEH) and kernel object manipulation. Together, the case reflects a level of sophistication specifically aimed at degrading EDR response capabilities before the final ransomware deployment.