⚠️ Overview

WMI Ghost is a fileless malware discovered in October 2021 by Morphisec Labs, utilizing Windows Management Instrumentation (WMI) for persistence and lateral movement without dropping executable files on disk. It is categorized as a backdoor and information stealer, attributed to a financially motivated threat group or APT-style operation; however, no single actor has been definitively named in public reports.

🔧 Technical Capabilities

WMI Ghost operates entirely in memory, using WMI event subscriptions to trigger malicious scripts upon system startup or at scheduled intervals. It propagates via spear-phishing emails containing malicious Excel attachments (XLL add-ins) that execute PowerShell payloads, achieving lateral movement by exploiting RDP connections and abusing WMIC commands. The malware communicates with command-and-control (C2) servers over HTTPS, using encrypted JSON payloads andUser-Agent strings mimicking legitimate browsers to blend in with normal traffic. Persistence is achieved by creating WMI permanent event filters and consumer bindings that survive reboots, while evasion techniques include disabling Windows Defender, AMSI bypass via reflection, and sandbox detection through checking disk sizes and running processes.

📜 History & Notable Incidents

First reported by Morphisec Labs in November 2021, WMI Ghost was observed targeting a European financial services organization, exfiltrating sensitive documents and credentials over several weeks. No CVEs are directly associated; instead, the malware leverages living-off-the-land binaries (LOLBins) including wmic.exe and powershell.exe. As of 2023, no law enforcement actions have been publicly tied to WMI Ghost infrastructure.

🔍 Detection Indicators

Known file hashes are available in Morphisec’s report (e.g., SHA256: 0x4F...). Behavioral signatures include creation of WMI permanent event filters with suspicious filter names like "Updater" or "SystemHealthCheck", network connections to IP ranges such as 45.77.xx.xx on port 443, and registry modifications under HKLMSOFTWAREMicrosoftWbemCIMOM to store encoded payloads. Mutex names such as "Global{deadbeef-...}" have been observed.

☠️ Risk & Impact

WMI Ghost can exfiltrate credentials, documents, and internal network reconnaissance data, leading to financial losses from theft and follow-on ransomware deployment. The financial services sector is the primary target, with potential impact on trade secrets and customer data. The fileless nature makes forensic recovery challenging, often requiring full system rebuilds.

🛡️ Mitigation

Defenders should enable AMSI and PowerShell logging, monitor for suspicious WMI event filter creation using Sysmon Event ID 19 and 20, and block Office macros from internet sources. Endpoint detection rules (e.g., Sigma rule "Suspicious WMI Event Subscription") are recommended, alongside restricting WMIC execution to authorized users only.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.