# MoiClient Backdoor: Multi-Stage Evasion via DLL Side-Loading, RPC UAC Bypass, and BYOVD Driver Abuse

> AhnLab ASEC documents MoiClient, a backdoor distributed via email as a disguised invoice, that side-loads through a renamed SumatraPDF viewer, injects into explorer.exe, bypasses UAC through the AppInfo RPC service, and abuses the vulnerable signed Lenovo PC Manager driver BootRepair.Sys to kill security processes before delivering the MoiXD Stealer.

- **Published:** 2026-09-02T00:00:00Z
- **Last reviewed:** 2026-09-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2288
- **ID:** TL-2026-2288
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8061

## Description

MoiClient is distributed by email as a .vhdx attachment disguised as an invoice. The virtual disk contains Invoice.Pdf.Exe, a renamed copy of the legitimate SumatraPDF viewer, and a malicious uxtheme.Dll placed in the same directory. When the victim opens Invoice.Pdf.Exe, the DLL search order causes SumatraPDF to load uxtheme.Dll automatically (classic DLL side-loading), silently executing MoiClient under the trust of a signed, legitimate PDF viewer.

Once running, uxtheme.Dll creates a suspended explorer.exe process, inserts shellcode staged in a companion file (data.Dat) at the process entry point, and resumes it, so MoiClient's core logic executes entirely inside a legitimate system process rather than as a standalone binary on disk.

MoiClient then escalates privileges without triggering a UAC prompt by interacting directly with the AppInfo (Application Information) service over its local ncalrpc RPC interface. This coerces the auto-elevating ComputerDefaults.Exe into launching with administrator rights; the malware's own sc.exe and PowerShell invocations inherit that elevated token, giving it silent, prompt-free administrative access.

With elevated privileges, MoiClient performs a Bring-Your-Own-Vulnerable-Driver (BYOVD) attack: it drops the legitimately Lenovo-signed but vulnerable BootRepair.Sys driver (Lenovo PC Manager v2.5.30.11281) as moimoi.Sys under %Public% and loads it as a kernel service. BootRepair.Sys exposes an unauthenticated IOCTL (control code 0x222014) that takes a raw process ID and passes it directly to the kernel API ZwTerminateProcess with no access-control check, letting any caller kill any process at ring 0. MoiClient uses this to enumerate and terminate Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG, and McAfee processes. Artifacts consistent with the public 'defendnot' technique (defendnot-loader.Exe, defendnot.Dll) are also present on affected hosts; defendnot separately neutralizes Windows Defender by registering a fake antivirus product through the undocumented Windows Security Center (WSC) API after DLL-injecting into a trusted signed process such as Taskmgr.exe, so Defender disables itself to avoid a conflict.

Persistence is established via a Task Scheduler entry named "MicrosoftWindowsUpdateTask" suffixed with a random four-digit number (or an appended period if the task already exists), masquerading as a Windows Update task. It fires every 30 minutes to relaunch the renamed SumatraPDF binary (demo.exe) and reload uxtheme.Dll, re-arming the infection chain across reboots and process termination.

MoiClient's final-stage payload, MoiXD Stealer, harvests browser-stored credentials entirely in memory using a ChromElevator-style bypass of Chromium's App-Bound Encryption (ABE): it hijacks the identity of a legitimate, trusted browser process to call the browser's own IElevator/IElevator2 COM decryption interface and recover the ABE master key, then decrypts cookies, saved passwords, and other protected browser data without ever touching disk.

No CVE has been assigned to BootRepair.Sys; it is catalogued in the LOLDrivers vulnerable-driver database without a CVE ID, distinct from the unrelated, separately-numbered CVE-2025-8061 affecting a different Lenovo Process Management driver (LnvMSRIO.sys). No C2 domains, IPs, or file hashes for the MoiClient/MoiXD components themselves were published in the source reporting.

## MITRE ATT&CK

- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1574.001 DLL
- T1055.012 Process Injection: Process Hollowing
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1543.003 Create or Modify System Process: Windows Service
- T1685 Disable or Modify Tools
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers

## Sources

- ["Evasive" Malware Attack Tactics: Hiding, Bypassing, and Reappearing](https://asec.ahnlab.com/en/95211/)
- [Hackers Can Weaponize Lenovo Driver to Terminate EDR Processes](https://cybersecuritynews.com/lenovo-driver-terminate-edr-processes/)
- [New 'Defendnot' tool tricks Windows into disabling Microsoft Defender](https://www.bleepingcomputer.com/news/microsoft/new-defendnot-tool-tricks-windows-into-disabling-microsoft-defender/)
- [BYOVD to the next level (part 1) — exploiting a vulnerable Lenovo driver (CVE-2025-8061)](https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html)
- [es3n1n/defendnot — An even funnier way to disable Windows Defender](https://github.com/es3n1n/defendnot)
- [BootRepair.sys driver record](https://www.loldrivers.io/drivers/7cc0a40d-7902-4400-9fc4-0070053991cb/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2288