GHOSTENGINE Malware Exploits Drivers to Terminate EDR Agents

Researchers discovered REF4578, an intrusion set that exploits vulnerable drivers to disable EDRs for crypto mining and deploys the GHOSTENGINE malware.

GHOSTENGINE manages the machine’s modules, primarily using HTTP to download files from a configured domain, with a backup IP if the domain is unavailable. It also uses FTP with embedded credentials as a backup protocol.

GHOSTENGINE Malware

Elastic Security Labs reports that the REF4578 intrusion began on May 6, 2024, with a PE file named Tiworker.exe masquerading as the genuine Windows TiWorker.exe.

Telemetry recorded alarms indicating the use of a known vulnerable driver.

When executed, this file downloads and runs a PowerShell script that controls the entire intrusion process. Analysis shows it uses a hardcoded PowerShell command to fetch an obfuscated script called get.png, which then downloads additional tools, modules, and configurations from the attacker’s C2 server. The script attempts to disable Windows Defender, enable remote services, and clean Windows event log channels.

To establish persistence, get.png creates the OneDriveCloudSync, DefaultBrowserUpdate, and OneDriveCloudBackup scheduled tasks as SYSTEM.

GHOSTENGINE installs modules to check for software updates, build security tools, and create a backdoor. The smartscreen.exe module’s main function is to terminate EDR agent processes before setting up a cryptocurrency miner.

“The ultimate goal of the REF4578 intrusion set was to gain access to an environment and deploy a persistent Monero crypto miner, XMRig,” researchers said.

Recommendation

Therefore, it is crucial to prevent and detect the following early actions:

• Suspicious PowerShell execution
• Execution from unusual directories
• Privilege escalation to system integrity
• Deployment of vulnerable drivers and related kernel mode services

IOCS