Evasive Malware Techniques for Defense Bypass and Persistence

Summary

A newly identified backdoor called MoiClient uses multiple evasion techniques, including DLL side-loading, Bring Your Own Vulnerable Driver (BYOVD), and RPC-based UAC bypass, to compromise Windows systems. The malware masquerades as an invoice and deploys the MoiXD Stealer to collect browser data. It establishes persistence through scheduled tasks and attempts to disable installed security software.

Investigation

AhnLab identified the MoiClient backdoor after analyzing its use of the moimoi string during BYOVD exploitation. The investigation traced a multi-stage execution chain beginning with a .Vhdx file containing a legitimate PDF viewer abused for DLL side-loading. Researchers also documented how the malware exploits the AppInfo local RPC interface to achieve privilege escalation.

Mitigation

Organizations should enforce strict driver signature policies and monitor systems for the installation of known vulnerable drivers. Restricting execution from %Public% and %LocalAppData% directories can further reduce the available attack surface. Security teams should also monitor unusual RPC activity involving the AppInfo service to identify potential UAC bypass attempts.

Response

If MoiClient activity is detected, responders should immediately terminate suspicious explorer.exe processes and remove malicious files from %Public% and %LocalAppData%. Unauthorized Task Scheduler entries matching the MicrosoftWindowsUpdateTask pattern should also be deleted. A complete forensic investigation should confirm that secondary payloads such as MoiXD Stealer are no longer present in memory or on disk.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access and is attempting to deploy the MoiClient backdoor. To evade detection, the attacker attempts to hide their presence by spawning a suspended instance of explorer.exe to prepare for process hollowing. Simultaneously, they leverage the legitimate Windows binary ComputerDefaults.exe to spawn a PowerShell instance, attempting to mask the execution of a malicious payload as a routine system configuration task.

• Regression Test Script:

  # Simulation Script for MoiClient Detection Validation
  # Note: This script requires administrative privileges to simulate certain behaviors.
  
  Write-Host "[+] Starting MoiClient Simulation..." -ForegroundColor Cyan
  
  # 1. Simulate Suspended Explorer.exe (T1055/T1055.003)
  Write-Host "[+] Simulating suspended explorer.exe..." -ForegroundColor Yellow
  Start-Process "C:Windowsexplorer.exe" -ArgumentList "/suspended" -ErrorAction SilentlyContinue
  
  # 2. Simulate Suspicious Task Scheduler Command (T1218)
  Write-Host "[+] Simulating suspicious task scheduler command..." -ForegroundColor Yellow
  # Note: We use cmd to call schtasks to simulate the command line pattern
  Start-Process "cmd.exe" -ArgumentList "/c schtasks /create /tn 'FakeTask' /tr 'task -print-to-default -silent file.Pdf' /sc once /st 00:00" -WindowStyle Hidden
  
  # 3. Simulate PowerShell inheriting from ComputerDefaults.exe (T1218.013)
  Write-Host "[+] Simulating PowerShell spawned from ComputerDefaults.exe..." -ForegroundColor Yellow
  Start-Process "C:WindowsSystem32ComputerDefaults.exe" -ArgumentList "powershell.exe -Command 'Write-Host MoiClient_Simulated'" -WindowStyle Hidden
  
  Write-Host "[+] Simulation commands dispatched." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup Script
  Write-Host "[+] Cleaning up simulation artifacts..." -ForegroundColor Cyan
  
  # Remove the fake scheduled task
  schtasks /delete /tn 'FakeTask' /f 2>$null
  
  # Note: Suspended processes and spawned instances are ephemeral or handled by OS cleanup.
  Write-Host "[+] Cleanup complete." -ForegroundColor Green