MoiClient Backdoor Uses UAC Bypass and Vulnerable Driver to Deploy Browser Stealer
Summary
AhnLab details MoiClient, a backdoor delivered in an invoice-themed VHDX that uses DLL side-loading, an RPC-based UAC bypass, and a vulnerable driver to disable security tools, persist, and deploy a browser-information stealer.
Key points
- The malware arrives in an invoice-themed VHDX email attachment containing a disguised PDF viewer and a malicious DLL loaded through DLL side-loading.
- MoiClient injects code into a suspended Explorer process and downloads additional payloads from its command-and-control server.
- An RPC-based AppInfo technique lets it bypass UAC and run processes with elevated privileges.
- It abuses a vulnerable Lenovo PC Manager driver to terminate processes associated with security products, and separately attempts to disable Windows Defender.
- A scheduled task relaunches the malware every 30 minutes using the legitimate SumatraPDF program and the malicious DLL.
- The additional payload, identified as MoiXD Stealer, targets browser information, including stored passwords.
- AhnLab recommends checking for suspicious Explorer processes, scheduled tasks, and specified MoiClient-related files.
Article Details
- Attack Vectors
- MoiClient is distributed in an email attachment: a VHDX file disguised as an invoice.
- Executing Invoice.Pdf.Exe loads the malicious uxtheme.Dll through DLL side-loading.
- MoiClient injects shellcode into a suspended explorer.Exe process and loads a further payload in memory.
- MoiClient uses an AppInfo RPC-based UAC bypass to run sc.Exe and PowerShell with elevated privileges.
- MoiClient exploits the vulnerable BootRepair.Sys driver from Lenovo PC Manager to terminate processes associated with security products.
- MoiClient downloads defendnot.DLL and defendnot-loader.Exe from its C2 server and executes them through PowerShell in an attempt to disable Windows Defender.
- MoiClient establishes persistence with a Task Scheduler job that reloads the malicious DLL every 30 minutes.
- MoiClient downloads the MoiXD Stealer payload and executes it in memory; the stealer uses ChromeElevator to steal browser information, including stored passwords.
- Defensive Notes
- Check for unintended explorer.Exe processes and terminate any that are found.
- Inspect Task Scheduler for suspicious jobs, including entries that run `demo.Exe` with `-print-to-default -silent file.Pdf`, and delete suspicious tasks.
- Check for and delete the listed suspected attack files if present: `%Public%\moimoi.Sys`, `%LOCALAPPDATA%\uxtheme.Dll`, `%LOCALAPPDATA%\data.Dat`, `%LOCALAPPDATA%\defendnot-loader.Exe`, and `%LOCALAPPDATA%\defendnot.Dll`.
MITRE ATT&CK
T1053.005 · Scheduled TaskMoiClient registers a Task Scheduler job that runs every 30 minutes and reloads the malicious DLL through demo.Exe.T1055 · Process InjectionMoiClient creates a suspended explorer.Exe process, places shellcode at its entry point, and uses it to run another injection routine and load a payload.T1059.001 · PowerShellMoiClient uses PowerShell to execute defendnot files with privileges obtained through its UAC bypass.T1105 · Ingress Tool TransferMoiClient downloads additional payloads, including the MoiXD Stealer payload, from its C2 server.T1548.002 · Bypass User Account ControlMoiClient uses an AppInfo RPC path and cloned elevated process handles so sc.Exe and PowerShell inherit elevated privileges and bypass UAC.T1555.003 · Credentials from Web BrowsersThe MoiXD Stealer uses ChromeElevator to steal information such as passwords stored in the browser.T1562.001 · Disable or Modify ToolsMoiClient uses a vulnerable BootRepair.Sys driver to terminate security-product processes and separately attempts to disable Windows Defender with Defendnot files.T1566.001 · Spearphishing AttachmentThe attack begins with an invoice-themed VHDX file sent by email.T1574.002 · DLL Side-LoadingExecuting Invoice.Pdf.Exe loads MoiClient from the same location through the malicious uxtheme.Dll.
Malware
Products
AvastThe processes targeted for termination include those from various security products, such as the Windows Defender family, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee.AVGThe processes targeted for termination include those from various security products, such as the Windows Defender family, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee.BitdefenderThe processes targeted for termination include those from various security products, such as the Windows Defender family, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee.BootRepair.SysIn this attack, version 2.5.30.11281 Of BootRepair.Sys—a vulnerable driver in Lenovo PC Manager—was exploited.KasperskyThe processes targeted for termination include those from various security products, such as the Windows Defender family, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee.Lenovo PC ManagerIn this attack, version 2.5.30.11281 Of BootRepair.Sys—a vulnerable driver in Lenovo PC Manager—was exploited.MalwarebytesThe processes targeted for termination include those from various security products, such as the Windows Defender family, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee.McAfeeThe processes targeted for termination include those from various security products, such as the Windows Defender family, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee.SumatraPDFInvoice.Pdf.Exe is SumatraPDF, a legitimate PDF viewer; all other files are marked as hidden, making it difficult for ordinary users to detect the presence of related files such as uxtheme.Dll.Windows DefenderThe processes targeted for termination include those from various security products, such as the Windows Defender family, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee.