Hunting Qilin Ransomware Group

As a front-line MDR SOC analyst, I just caught Qilin Ransomware Group, and not from an encryption alert.

From a reconnaissance alert. Yup you read that right! Yes. Recon.

Before detonation. Before impact. Before damage.

It all started with a compromised service account.

No encryption. No ransom note. Just subtle behavioral drift.

The threat actor established foothold and immediately modified remote access controls:

• Enabled Remote Desktop via netsh.exe (advfirewall firewall set rule “group=remote desktop” new enable=yes)

• Modified fDenyTSConnections via reg.exe (add “HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server” /v fDenyTSConnections /t REG_DWORD /d 0 /f )

• Parent process? wsmprovhost.exe

That parent process matters. wsmprovhost.exe indicates execution over WinRM (Windows Remote Management) — meaning this wasn’t random malware execution. This was remote, authenticated access.

After establishing access, the actor moved into internal reconnaissance using built-in utilities:

• net.exe / net1.exe • ipconfig.exe • ping.exe • nslookup.exe • hostname.exe

Living-off-the-land binaries (LOLBins). No custom payloads. No obvious malware. Just native tooling. Quiet mapping. Intent forming. This was the staging phase.

And that behavior chain:

Service account compromise → WinRM execution → RDP enablement → Internal recon — is consistent with pre-ransomware deployment activity.

Within the same timeframe, The actor dropped and executed:

• *meshagent64-.com.exe**
• *meshagent64-.exe**
• meshagent.exe

Yes — MeshAgent. An RMM tool. And here’s the twist: Mesh was already heavily used within the organization. Living-of-the-land Remote Monitoring and Management tools (LolRMMs). That’s what makes this tradecraft effective. It blends in. It inherits trust. It bypasses suspicion because “we use this tool.”

Then I saw cleanup behavior:

• cmd.exe /C CHOICE /C Y /N /D Y /T 10 & del “C:\Program Files\Mesh Agent\MeshAgent.exe”

• choice.exe CHOICE /C Y /N /D Y /T 10

What it means?

1. Timed deletion.
2. Replace existing agent.
3. Install attacker-controlled instance.
4. Establish persistent remote access.

And it didn’t stop at LOLRMM persistence.

The staging directory? C:\PerfLogs\

Here’s what was dropped and executed from (C:\Program Files\Mesh Agent\MeshAgent.exe):

1. Network Scanning Toolkit

• netscan.exe • netscan.xml • netscan.lic • Multiple .tmp files • Supporting DLLs: libsmb2.dll, libsmi2.dll

2. Credential & Data Collection Staging

• audit.zip • Credentials folder • 64-bit.zip • s5cmd.exe

3. Active Directory Extraction

Executed via: C:\Windows\System32\ntdsutil.exe

Artifacts created:

• ntds.dit • ntds.jfm • SYSTEM • SECURITY

Purpose:

1. built internal network enumeration. SMB discovery. Host mapping. Likely identifying high-value systems before lateral movement.

2. s5cmd.exe is an S3-compatible bulk data transfer tool. That’s not for recon. That’s staging for exfiltration and Compressed archives + credential folders strongly indicate data aggregation prior to transfer

3. ntdsutil.exe dumping ntds.dit means Active Directory database extraction.

And before all of that happened, this was executed:

• E:*(not system32)\(not windows)*\explorer.exe

This also loaded:

• C:\ProgramData\OEM\Firmware\OemHwUpd.sys
• SHA256: 3111F4D7D4FAC55103453C4C8ADB742DEF007B96B7C8ED265347DF97137FBEE0

○ Digitally Signed ○ Signature: Guidance Software, Inc. ○ Signature Status: Valid

Let’s be clear:

That is not the legitimate Windows Explorer binary. The real one lives in: C:\Windows\explorer.exe. That makes it a payload.

The driver:

• Lives in an actual expected path • Has a valid digital signature • Loads successfully without raising obvious red flags

This is what we call Living-Off-the-Land Drivers (LOLDDrivers). When a signed driver is weaponized, detection becomes exponentially harder.

To wrap it up, this is what makes Qilin Ransomware dangerous.

They’re not noisy. They’re not one-dimensional. And they don’t rely on a single exploit chain.

They adapt their TTPs per victim. They blend into legitimate activity. They weaponize trust.

Qilin is known for running full-spectrum operations:

• Defense evasion using signed drivers (LOLDDrivers) • Living-off-the-land execution with native Windows binaries (LOLBins) • Persistence through abused remote management tools (LOLRMMs)

And that’s why early-stage detection at recon, at behavioral deviation, at subtle parent-child anomalies, matters more than ever. Because by the time encryption starts, the attacker has already won. This time, they didn’t.