# Invisible miners: unveiling GHOSTENGINE’s crypto mining operations

GHOSTENGINE intrusion abuses vulnerable Avast and IObit drivers to kill EDR agents, then installs persistent XMRig Monero miner on victim hosts.

- Payout: Real-world hack
- Severity: high
- Program: Windows endpoints
- Credited: Salim Bitam,Samir Bousseaden,Terrance DeJesus,Andrew Pease
- Disclosed: 2024-05-22
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/invisible-miners-unveiling-ghostengine
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-invisible-miners-unveiling-ghostengine
- Tags: domain:desktop impact:integrity impact:internal-access kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:reverse-engineering vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows endpoint EDR agents and kernel drivers
**Root cause:** Signed but vulnerable Avast aswArPots.sys and IObit iobitunlockers.sys drivers expose IOCTLs (0x7299C004, 0x222124) that let any caller terminate processes and delete files, bypassing EDR self-protection.
**Steps:**
1. Drop Tiworker.exe stager, which runs a hardcoded PowerShell one-liner to fetch `get.png` from C2.
2. get.png downloads `clearn.png` to purge prior infections and scheduled tasks (Microsoft Assist Job, System Help Center Job, SystemFlushDns, SystemFlashDnsSrv).
3. get.png disables Windows Defender, clears event log channels, empties Temp/Logs/Recycle.Bin, enables remote services.
4. get.png creates SYSTEM scheduled tasks OneDriveCloudSync (msdtc loads `oci.dll`), DefaultBrowserUpdate (`run.bat`), OneDriveCloudBackup (`smartsscreen.exe`).
5. Downloads `aswArPots.sys` and `IObitUnlockers.sys` to `C:\Windows\System32\drivers\`.
6. smartsscreen.exe enumerates processes against hardcoded EDR list, sends IOCTL `0x7299C004` to aswArPots.sys to kill by PID, then IOCTL `0x222124` to iobitunlockers.sys to delete the binary.
7. Downloads XMRig as `taskhostw.png` plus `WinRing0x64.sys` and `config.json`, executes miner against pool.supportxmr.com:443.
8. kill.png injects shellcode to load a C++ PE that continuously re-scans and kills new EDR processes.
9. backup.png polls C2 with Base64 JSON `{"id":...,"host":...}` and executes Base64-encoded commands.
**How found:** Elastic detected Tiworker.exe execution and vulnerable-driver alerts in telemetry on 2024-05-06, then reverse-engineered the PowerShell chain, extracted XMRig config, and pivoted to the Monero payment ID to observe pool statistics and withdrawals.
**Exploitation:** Attacker gains initial execution, drops stager that pulls PowerShell modules over HTTP/FTP from yrnvtklot[.]com (backup IP 111.90.158.40). Loads signed vulnerable drivers to terminate and delete EDR agents, establishes SYSTEM persistence via msdtc phantom DLL and scheduled tasks, then runs XMRig mining to pool.supportxmr.com with attacker's Monero wallet, extracting value via mining rewards.
**Escalation:** Redundant kill modules (smartsscreen.exe and kill.png) plus update/persistence via oci.dll ensure miner survives EDR restarts and re-infection; multiple scheduled tasks and C2 fallbacks provide resilience.
**Insight:** Miner config files are high-value: the XMRig `user` field is a Monero wallet/payment ID that can be queried on public pool dashboards and blockchain explorers to enumerate active victims, worker uptime, and total earnings — useful for scoping an intrusion even when host telemetry is wiped.