MoiClient Backdoor: Multi-Stage Evasion via DLL Side-Loading, RPC UAC Bypass, and BYOVD Driver Abuse — Threadlinqs Intelligence
As of 2026-09-02, MoiClient Backdoor: Multi-Stage Evasion via DLL Side-Loading, RPC UAC Bypass, and BYOVD Driver Abuse is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-2288 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
AhnLab ASEC documents MoiClient, a backdoor distributed via email as a disguised invoice, that side-loads through a renamed SumatraPDF viewer, injects into explorer.exe, bypasses UAC through the
MoiClient is distributed by email as a .vhdx attachment disguised as an invoice. The virtual disk contains Invoice.Pdf.Exe, a renamed copy of the legitimate SumatraPDF viewer, and a malicious uxtheme.Dll placed in the same directory. When the victim opens Invoice.Pdf.Exe, the DLL search order causes SumatraPDF to load uxtheme.Dll automatically (classic DLL side-loading), silently executing MoiClient under the trust of a signed, legitimate PDF viewer.
Once running, uxtheme.Dll creates a suspended explorer.exe process, inserts shellcode staged in a companion file (data.Dat) at the process entry point, and resumes it, so MoiClient's core logic executes entirely inside a legitimate system process rather than as a standalone binary on disk.
MoiClient then escalates privileges without triggering a UAC prompt by interacting directly with the AppInfo (Application Information) service over its local ncalrpc RPC interface. This coerces the auto-elevating ComputerDefaults.Exe into launching with administrator rights; the malware's own sc.exe and PowerShell invocations inherit that elevated token, giving it silent, prompt-free administrative access.
With elevated privileges, MoiClient performs a Bring-Your-Own-Vulnerable-Driver (BYOVD) attack: it drops the legitimately Lenovo-signed but vulnerable BootRepair.Sys driver (Lenovo PC Manager v2.5.30.11281) as moimoi.Sys under %Public% and loads it as a kernel service. BootRepair.Sys exposes an unauthenticated IOCTL (control code 0x222014) that takes a raw process ID and passes it directly to the kernel API ZwTerminateProcess with no access-control check, letting any caller kill any process at ring 0. MoiClient uses this to enumerate and terminate Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee processes. Artifacts consistent with the public 'defendnot' technique (defendnot-loader.Exe, defendnot.Dll) are also present on affected hosts; defendnot separately neutralizes Windows Defender by registering a fake antivirus product through the undocumented Windows Security Center (WSC) API after DLL-injecting into a trusted signed process such as Taskmgr.exe, so Defender disables itself to avoid a conflict.
Persistence is established via a Task Scheduler entry named "MicrosoftWindowsUpdateTask" suffixed with a random four-digit number (or an appended period if the task already exists), masquerading as a Windows Update task. It fires every 30 minutes to relaunch the renamed SumatraPDF binary (demo.exe) and reload uxtheme.Dll, re-arming the infection chain across reboots and process termination.
MoiClient's final-stage payload, MoiXD Stealer, harvests browser-stored credentials entirely in memory using a ChromElevator-style bypass of Chromium's App-Bound Encryption (ABE): it hijacks the identity of a legitimate, trusted browser process to call the browser's own IElevator/IElevator2 COM decryption interface and recover the ABE master key, then decrypts cookies, saved passwords, and other protected browser data without ever touching disk.
No CVE has been assigned to BootRepair.Sys; it is catalogued in the LOLDrivers vulnerable-driver database without a CVE ID, distinct from the unrelated, separately-numbered CVE-2025-8061 affecting a different Lenovo Process Management driver (LnvMSRIO.sys). No C2 domains, IPs, or file hashes for the MoiClient/MoiXD components themselves were published in the source reporting.
Weaknesses (CWE)
CWE-284, CWE-862, CWE-427
Timeline
- AhnLab ASEC publishes analysis of the MoiClient backdoor, documenting distribution via a .vhdx email attachment disguised as an invoice.
- Victim opens Invoice.Pdf.Exe, a renamed SumatraPDF viewer bundled in the .vhdx, triggering automatic loading of the malicious uxtheme.Dll from the same directory (DLL side-loading).
- uxtheme.Dll creates a suspended explorer.exe process and injects shellcode staged in data.Dat into its entry point, executing MoiClient in memory inside a trusted system process.
- MoiClient calls the AppInfo service's local ncalrpc RPC interface to force ComputerDefaults.Exe to auto-elevate, granting its own sc.exe and PowerShell child processes administrator privileges without a UAC prompt.
- MoiClient drops the vulnerable, Lenovo-signed BootRepair.Sys driver as moimoi.Sys under %Public%, loads it as a kernel service, and abuses its unauthenticated IOCTL 0x222014 to terminate Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee processes.
- MoiClient registers a Task Scheduler task named 'MicrosoftWindowsUpdateTask' plus a random four-digit suffix that fires every 30 minutes to relaunch the renamed SumatraPDF binary (demo.exe) and reload uxtheme.Dll.
- MoiClient delivers the MoiXD Stealer payload, which uses a ChromElevator-style App-Bound Encryption bypass to decrypt and steal browser-stored passwords and credentials entirely in memory.
Detections & IOCs
As of 2026-09-03, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.001, T1204.002, T1574.001, T1055.012, T1548.002, T1543.003, T1685, T1053.005, T1036.005, T1027
