“Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing

What Happened

Attackers are sending fake invoice emails that contain a disguised file. When opened, this file secretly installs a backdoor program called MoiClient. This backdoor hides inside legitimate Windows programs to avoid detection, tricks Windows into giving it administrator permissions, and then disables antivirus software by exploiting a known flaw in a Lenovo driver. It keeps itself running by scheduling automatic restarts every 30 minutes. Once installed, it downloads additional malware that steals saved passwords from web browsers. Organizations should check for suspicious scheduled tasks, unexpected explorer.exe processes, and files named moimoi.Sys, uxtheme.Dll, data.Dat, defendnot-loader.Exe, and defendnot.Dll on affected systems.

Key Takeaways

• MoiClient backdoor distributed via phishing emails as .VHDX files disguised as invoices, using SumatraPDF (Invoice.Pdf.Exe) for DLL side-loading of malicious uxtheme.Dll
• Employs RPC-based UAC bypass via AppInfo service interface, cloning elevated process handles from ComputerDefaults.Exe to run sc.exe and PowerShell with elevated privileges
• Uses BYOVD technique exploiting BootRepair.Sys (Lenovo PC Manager driver v2.5.30.11281), dropped as moimoi.Sys in %Public%, to terminate security products including Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee
• Establishes persistence via Task Scheduler running every 30 minutes with task names matching pattern MicrosoftWindowsUpdateTask####, relaunching DLL side-loading chain through renamed SumatraPDF (demo.Exe)
• Final payload c.Txt identified as MoiXD Stealer, executed in memory via CreateThread(), steals browser passwords using ChromeElevator

Affected Systems

• Windows systems with User Account Control enabled
• Systems running security products from Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, or McAfee
• Systems where Lenovo PC Manager driver BootRepair.Sys may be present or can be loaded

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Phishing email delivers .VHDX file disguised as invoice containing Invoice.Pdf.Exe (SumatraPDF) and hidden uxtheme.Dll
2. Execution: User runs Invoice.Pdf.Exe which side-loads uxtheme.Dll (MoiClient backdoor) via DLL search order hijacking
3. Defense Evasion: MoiClient creates suspended explorer.exe, injects shellcode from data.Dat into entry point, executes final payload in memory
4. Privilege Escalation: UAC bypass via RPC AppInfo interface; debugs winver.exe, launches ComputerDefaults.exe, clones elevated process handle as parent for sc.exe and PowerShell
5. Defense Evasion: BYOVD drops BootRepair.Sys (Lenovo PC Manager v2.5.30.11281) as moimoi.Sys, registers kernel driver, terminates security product processes; downloads and executes defendnot to disable Windows Defender
6. Persistence: Task Scheduler job created running every 30 minutes named MicrosoftWindowsUpdateTask####, relaunches demo.Exe to reload uxtheme.Dll
7. Exfiltration: Downloads c.Txt (MoiXD Stealer) from C2, executes in memory via CreateThread(), steals browser passwords using ChromeElevator

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules are provided in the article. The article describes manual investigation steps including checking for unintended explorer.exe processes, suspicious Task Scheduler entries, and specific file paths. Additional IOCs and detailed analysis are stated to be available via AhnLab TIP subscription.

Detection Engineering Assessment

Required Log Sources

• Windows Event Log - Security (process creation, service installation)
• Windows Event Log - Sysmon (DLL loading, file creation, process injection, driver loading)
• Windows Task Scheduler logs
• EDR telemetry (process ancestry, DLL side-loading alerts, kernel driver loading)
• RPC endpoint logs for AppInfo service activity

Hunting Hypotheses

Control Gaps

• Application allowlisting may not flag renamed legitimate binaries such as SumatraPDF (Invoice.Pdf.Exe, demo.Exe)
• BYOVD technique can terminate EDR and antivirus processes at kernel level, creating a detection blind spot after driver loading
• UAC bypass via RPC AppInfo interface may not generate alerts on systems without UAC bypass detection rules
• DLL side-loading using legitimate signed binaries may bypass application control policies that trust the parent binary

Key Behavioral Indicators

• SumatraPDF binary (potentially renamed) loading uxtheme.Dll from same directory or %LOCALAPPDATA%
• explorer.exe created in suspended state followed by entry point modification
• ComputerDefaults.exe acting as parent process for sc.exe or powershell.exe
• Kernel driver service registration with binary path in %Public% directory
• Task Scheduler job named MicrosoftWindowsUpdateTask followed by 4-digit number
• Driver device \.\BootRepair receiving process IDs for termination
• defendnot-loader.Exe and defendnot.Dll executed via PowerShell with elevated privileges

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether driver blocklisting can be applied to BootRepair.Sys (Lenovo PC Manager driver v2.5.30.11281) if it is not required in your environment
• Consider implementing Windows Defender Application Control or similar application allowlisting to restrict execution of binaries from %LOCALAPPDATA% and %Public% directories
• If supported by your tooling, consider enabling monitoring for RPC connections to the AppInfo service interface from non-standard processes
• Evaluate whether UAC settings can be configured to the highest level to reduce the effectiveness of RPC-based UAC bypass techniques

User Protection

• Consider deploying email filtering rules to block or quarantine .VHDX file attachments, especially those claiming to contain invoices
• If your EDR supports DLL side-loading detection, consider enabling alerts for SumatraPDF or renamed SumatraPDF binaries loading DLLs from user-writable directories
• Evaluate whether kernel driver loading from non-standard paths such as %Public% can be blocked or alerted on

Security Awareness

• Consider reminding employees that invoice-related emails with executable or virtual disk attachments are a common attack vector and should be reported to security teams
• Consider incorporating awareness training on the risks of opening files with double extensions such as .Pdf.Exe
• If applicable to your awareness program, consider highlighting that legitimate invoices are typically delivered as standard PDF files, not .VHDX or executable files

MITRE ATT&CK Mapping

Additional IOCs

• File Paths:
  • %Public%\moimoi.Sys - Drop location for vulnerable BootRepair.Sys driver renamed to moimoi.Sys for BYOVD attack
  • %LOCALAPPDATA%\uxtheme.Dll - Drop location for malicious MoiClient DLL loaded via side-loading
  • %LOCALAPPDATA%\data.Dat - Drop location for shellcode file injected into explorer.exe entry point
  • %LOCALAPPDATA%\defendnot-loader.Exe - Drop location for Windows Defender disabling tool downloaded from C2
  • %LOCALAPPDATA%\defendnot.Dll - Drop location for Windows Defender disabling DLL downloaded from C2
• Command Lines:
  • Purpose: Task Scheduler persistence command relaunching DLL side-loading chain every 30 minutes | Tools: schtasks, SumatraPDF | Stage: Persistence | %LOCALAPPDATA%\demo.Exe -print-to-default -silent file.Pdf
  • Purpose: Registration and execution of kernel driver service for BYOVD attack | Tools: sc.exe | Stage: Defense Evasion | sc.exe create <servicename> binpath=
• Other:
  • MicrosoftWindowsUpdateTask - Base string used for Task Scheduler job names; appended with 4-digit number (e.g., MicrosoftWindowsUpdateTask1234) or periods for subsequent jobs
  • \\.\BootRepair - Device name used by moimoi.Sys kernel driver to receive PIDs of security product processes for termination