The file arrives as an invoice. Inside the disk image is Invoice.pdf.exe, which really is SumatraPDF, a legitimate open source PDF reader. Every other file is marked hidden, including one called uxtheme.dll. Open the document and Windows loads that DLL from the same folder, because that is what Windows does, and the backdoor is running.
The lure is ordinary. What comes after it is not.
Researchers at AhnLab have documented the backdoor, which they call MoiClient after the "moimoi" string it leaves behind. It bypasses Windows privilege prompts without ever triggering one, loads a vulnerable Lenovo driver to shut down seven families of security software, and relaunches itself every 30 minutes through the Task Scheduler.
A real PDF reader doing the dirty work
MoiClient ships as a .vhdx virtual disk. SumatraPDF is genuine; the malicious code sits in uxtheme.dll beside it and loads by side-loading, which works because Windows searches a program's own folder for a DLL first. Once running, MoiClient starts a suspended explorer.exe, writes shellcode from a neighbouring data.dat file over that process's entry point, and lets the injected code load the final payload in memory. The malware ends up executing inside a process every defender expects to see.
Borrowing administrator rights instead of asking
To disable security products, MoiClient needs elevation, and it takes it without showing the user a consent prompt. It connects over local RPC to the AppInfo service, the component behind User Account Control, and runs winver.exe as a debug target to obtain a debug object handle. It then runs ComputerDefaults.exe, a system binary Windows elevates automatically, through the same interface and clones its process handle. Setting that cloned handle as the parent for new sc.exe and PowerShell processes makes them inherit the elevation. AhnLab notes the approach resembles an AppInfo local RPC technique described by Google Project Zero.
A Lenovo driver turned into a kill switch
With rights in hand, MoiClient reaches for a vulnerable signed driver, a technique called bring your own vulnerable driver. In this case it was BootRepair.sys version 2.5.30.11281, shipped with Lenovo PC Manager. The malware drops it into the %Public% folder as moimoi.sys, registers it as a kernel service, then passes the process ID of anything security related to the driver device to be terminated. AhnLab lists Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG and McAfee among the targets. Defender gets extra attention: MoiClient downloads defendnot.dll and defendnot-loader.exe from its command server and runs them in PowerShell to switch it off.
It comes back every 30 minutes
Persistence is a scheduled task. MoiClient creates a job named MicrosoftWindowsUpdateTask followed by four arbitrary digits, or appends a period to the name of one that already exists. The task fires every 30 minutes, launching a copy of SumatraPDF renamed demo.exe, which loads uxtheme.dll from the same folder and starts the whole chain again. The payload it fetches, a file named c.txt, was identified at analysis time as MoiXD Stealer, which uses ChromeElevator to lift saved browser passwords.
What to check on a suspect machine
AhnLab's triage steps are short. Look for unexpected explorer.exe processes and kill them. Open the Task Scheduler and look for an entry running demo.exe with print-to-default and silent switches against a PDF. Then check for these files, which should not be there: %Public%\moimoi.sys, and in %LOCALAPPDATA%, uxtheme.dll, data.dat, defendnot-loader.exe and defendnot.dll.
None of the individual moves here is novel. A signed driver killing antivirus is the same pattern seen when fake quote emails delivered a stealer that disabled security tools, and DLL side-loading behind a legitimate application drove a backdoor that rode a signed adware installer onto Windows PCs. The lesson is in the stacking: a trusted reader, a trusted Windows service, a trusted vendor driver and a trusted-looking scheduled task, none of which is malicious on its own.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.