By 
A malicious crypto mining campaign called 'REF4578,' was found deploying a malicious payload named GhostEngine that uses vulnerable drivers to turn off security products and deploy an XMRig miner.
Researchers at Elastic Security Labs and Antiy have underlined the unusual sophistication of these crypto-mining attacks in separate reports and shared detection rules to help defenders identify and stop them.
However, the activity has not been attributed to any known threat actors, so the campaign's origin and scope remain unknown.
It is not known how the servers are initially breached, but the threat actor's attack starts with the execution of a file named 'Tiworker.exe,' which disguises as a legitimate Windows file.
This executable is the initial staging payload for GhostEngine, a PowerShell script that downloads various modules to conduct different behaviors on an infected device.
When Tiworker.exe is executed, it will download a PowerShell script named 'get.png' from the attacker's command and control (C2) server, which acts as GhostEngine's primary loader.
This PowerShell script downloads additional modules and their configurations, disables Windows Defender, enables remote services, and clears various Windows event logs.
Next, get.png verifies that the system has at least 10MB of free space, which is required for continuing the infection, and creates scheduled tasks named 'OneDriveCloudSync,' 'DefaultBrowserUpdate,' and 'OneDriveCloudBackup,' for persistence.
The PowerShell script then download and launch an executable named smartsscreen.exe, which acts as GhostEngine's primary payload.
This malware terminates and deletes EDR software and download and launch the XMRig to mine for cryptocurrency.
To terminate EDR software, GhostEngine loads two vulnerable kernel drivers: aswArPots.sys (Avast driver), which is used to terminate EDR processes, and IObitUnlockers.sys (Iobit driver) to delete the associated executable.
For persistence, a DLL named 'oci.dll' is loaded by a Windows service named 'msdtc'. When started, this DLL will download a fresh copy of 'get.png' to install the latest version of GhostEngine on the machine.
Elastic researchers suggest defenders look out for suspicious PowerShell execution, unusual process activity, and network traffic pointing to crypto-mining pools.
Additionally, deploying vulnerable drivers and creating associated kernel mode services should be treated as red flags in any environment.
An aggressive measure is to block file creation from vulnerable drivers like aswArPots.sys and IobitUnlockers.sys.
Image Credits : Bitcoin Magazine
