“Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing

 

People who initially seem fine but tend to subtly avoid others as the relationship deepens or when conflicts arise—and who disappear when pressured—are commonly referred to as “avoidant types.” By repeatedly pulling away only to reappear, they drain the other person’s emotions and energy, ultimately undermining the relationship.

The attack pattern of the recently identified “MoiClient” backdoor exhibits similar behavior. It lowers users’ guard by disguising itself as an invoice, executes while hidden within legitimate programs, and finds alternative paths whenever it encounters security controls. It bypasses permission controls and exploits vulnerable drivers to neutralize even security products designed to block it, while repeatedly executing itself through the Task Scheduler. Let’s take a closer look at MoiClient’s attack method: it bypasses obstacles when blocked and hides again when attempts are made to detect it.

 

An Evasive Backdoor Disguised as an Invoice

AhnLab recently identified cases of backdoor distribution utilizing BYOVD (Bring Your Own Vulnerable Driver) and RPC-based UAC bypass techniques. BYOVD is a method that co-opts legitimate drivers containing vulnerabilities for exploitation. AhnLab named this backdoor “MoiClient” based on the “moimoi” string it uses when executing the BYOVD technique.

The attack begins with an invoice sent via email. MoiClient is distributed as a .Vhdx file that is disguised as an invoice, which contains Invoice.Pdf.Exe—a file that appears to be a PDF document—and uxtheme.Dll. Here, uxtheme.Dll is the malicious DLL used by MoiClient. Invoice.Pdf.Exe is SumatraPDF, a legitimate PDF viewer; all other files are marked as hidden, making it difficult for ordinary users to detect the presence of related files such as uxtheme.Dll.

When a user executes Invoice.Pdf.Exe, believing it to be a PDF document, uxtheme.Dll—located in the same Path—is loaded via DLL side-loading, thereby executing MoiClient. MoiClient then receives an additional payload from the threat actor’s C2 server and executes it in memory. As of the time of analysis, this payload was identified as “MoiXD Stealer,” which steals browser information.

 

[Figure 1] Contents of the .Vhdx file

 

MoiClient Disguised as a Legitimate Process

After initially launching, MoiClient executes the final malicious payload through a multi-stage injection process as follows.

---

Creation of an explorer.Exe process in the “Suspended” state

↓

Inserting shellcode from the data.Dat file (with the same Path) into the entry point (EP) of the explorer.Exe process

↓

The inserted shellcode executes an additional injection routine

↓

Loads and executes the final payload in memory

---

In other words, this method involves initially executing the malware using a legitimate program familiar to the user, then shifting its execution environment into a legitimate Windows process to proceed to the next Attack Stage.

[Figure 2] EP Overwrite & Execution Routine

[Figure 3] Shellcode Injection Result

 

Privilege Escalation Without a Direct Confrontation

MoiClient also uses an RPC-based UAC bypass technique to perform tasks that require elevated privileges, such as disabling security products. This method is similar to the AppInfo local RPC interface exploitation technique introduced by Google Project Zero.

MoiClient uses the ncalrpc protocol sequence to connect to the RPC interface of the AppInfo Service, then executes winver.Exe as a debug target and acquires the debug object handle. It then executes ComputerDefaults.Exe—a system binary that automatically performs privilege escalation—through the same AppInfo RPC path and receives the associated debug events. During this process, it acquires and clones the process handle of ComputerDefaults.Exe.

[Figure 4] Connecting to the AppInfo RPC Interface

[Figure 5] Routine for Acquiring a Debug Object

[Figure 6] Routine for Acquiring the ComputerDefaults.Exe Process Handle

 

The cloned handle is set as the parent process for both the sc.Exe and PowerShell processes. Consequently, these processes inherit the elevated privileges of ComputerDefaults.Exe—which is already running with elevated privileges—allowing them to bypass UAC.

[Figure 7] Execution of the UAC Bypass Process

 

Disabling Security Products That Block It

Once it has gained privileges, MoiClient uses the BYOVD technique to neutralize security products that could detect or block it.

In this attack, version 2.5.30.11281 Of BootRepair.Sys—a vulnerable driver in Lenovo PC Manager—was exploited. MoiClient creates this driver in the %Public% Path under the name moimoi.Sys, then uses the previously performed UAC bypass to register and execute the kernel driver Service.

[Figure 8] Dropping the BootRepair.Sys file

[Figure 9] Registration and Execution of the Kernel Driver Service

 

It then checks the list of running processes; if any processes related to security software are detected, it passes the corresponding PID to the \\.\BootRepair device to terminate them. The processes targeted for termination include those from various security products, such as the Windows Defender family, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee.

[Figure 10] Part of the BootRepair.Sys dispatch routine

A separate method is also used to target
Windows Defender. MoiClient downloads defendnot.DLL and defendnot-loader.Exe from the C2 server, then executes them in PowerShell using privileges obtained through UAC bypass to attempt to disable Windows Defender.

[Figure 11] To download and execute the Defendnot program

[Figure 12] Disabled Windows Defender

Just when it seemed to
disappear, it reappears every 30 minutes

MoiClient registers a Task Scheduler job to continue the attack even after it has been executed once.

First, it checks the list of existing Task Scheduler jobs. If no existing jobs are found, it creates a job name by appending an arbitrary four-digit number to “MicrosoftWindowsUpdateTask”; if an existing job exists, it appends a period (.) To the end of that job name.

• If no existing task exists: MicrosoftWindowsUpdateTask1234
• If an existing task exists: Task Name.

The registered task runs every 30 minutes. At that time, SumatraPDF—named “demo.Exe”—is launched, and “uxtheme.Dll,” which is located in the same Path and is actually MoiClient, is reloaded. Consequently, the DLL sideloading process used during the initial execution phase is repeated via the Task Scheduler.

[Figure 13] Created Task Scheduler

The ultimate goal
of the bypass is Information Theft of browser information

Having neutralized security products and established persistence, MoiClient downloads an additional payload named “c.Txt” from the C2 server.

[Figure 14] Download of Additional C2 Payload

The
downloaded payload is executed in memory using CreateThread(). As of the time of analysis, c.Txt was identified as “MoiXD Stealer,” which uses ChromeElevator to perform Information Theft on information such as passwords stored in the browser.

[Figure 15] In-memory Memory Execution of Additional C2 Payload

Ultimately, this attack does not end with the simple execution of an email Attachment. After tricking the user into opening a file disguised as an invoice, the attack leverages legitimate programs and processes, bypasses privilege controls, and even neutralizes security products by exploiting vulnerable drivers. It then runs repeatedly through the Task Scheduler to download additional malware and continues the attack by conducting Information Theft.

If you suspect a
persistent, evasive MoiClient infection

If you suspect a MoiClient infection, you should check the following items in order.

1. Check
   for unintended explorer.Exe processes: Verify whether any unintended explorer.Exe processes are running, and if found, terminate them immediately.
2. Check
   the Task Scheduler: Check for any suspicious tasks and delete them if found. In particular, you need to check for entries configured to run `demo.Exe` as shown below:
   – `LOCALAPPDATA%\demo.Exe -print-to-default -silent file.Pdf`
3. Check
   for the Presence of Related Files Check whether the following files exist on the system. If any of these files are found, they are likely the Malicious Files used in this attack and must be deleted immediately.

• %Public%\moimoi.Sys
• %LOCALAPPDATA%\uxtheme.Dll
• %LOCALAPPDATA%\data.Dat
• %LOCALAPPDATA%\defendnot-loader.Exe
• %LOCALAPPDATA%\defendnot.Dll