MoiClient: an invoice-themed backdoor chains an RPC-based UAC bypass with a vulnerable Lenovo PC Manager driver to kill security products and steal browser credentials

AhnLab's ASEC documents MoiClient (named for the "moimoi" string in its BYOVD component) distributed as a .vhdx file disguised as an invoice email attachment. The archive contains Invoice.Pdf.Exe, actually the legitimate SumatraPDF viewer, used to DLL-sideload a same-directory malicious uxtheme.dll, plus hidden support files (AhnLab ASEC, 2026-09-01). Execution moves into a legitimate process via classic process hollowing: MoiClient spawns explorer.exe suspended and overwrites its entry point with shellcode from a co-located data.dat. For privilege escalation, MoiClient connects over ncalrpc to the RPC interface of the AppInfo Service, launches winver.exe as a debug target to acquire a debug-object handle, then drives ComputerDefaults.exe (a system binary that auto-elevates) through the same RPC path, clones its process handle, and sets that cloned handle as the parent of subsequent sc.exe and PowerShell processes so they inherit elevated privileges with no UAC prompt shown (AhnLab ASEC, 2026-09-01). With elevated rights, MoiClient drops a vulnerable Lenovo PC Manager kernel driver, version 2.5.30.11281 of BootRepair.sys, under the name moimoi.sys in the %Public% path, registers it as a kernel service, and uses its device interface to pass process IDs of running security products for forced termination, targeting Windows Defender, Malwarebytes, Bitdefender, Kaspersky, Avast, AVG and McAfee by process name (AhnLab ASEC, 2026-09-01). A separate technique specifically neutralises Windows Defender: MoiClient downloads defendnot.dll and defendnot-loader.exe from its command-and-control server and runs them through the elevated PowerShell session. Persistence is a Task Scheduler job named MicrosoftWindowsUpdateTask<4-digit-number> (or the existing name with a trailing period appended on a collision) that fires every 30 minutes, re-launching the renamed SumatraPDF binary to re-trigger the DLL-sideload chain (AhnLab ASEC, 2026-09-01). The final payload, "MoiXD Stealer," runs in memory and uses a ChromeElevator-style technique to steal browser-stored passwords.

Triage: the RPC-based UAC bypass, cloning a process handle obtained through winver.exe as a debug target and attaching it as the parent of sc.exe or PowerShell, resembles a technique class Google Project Zero documented in 2019 against the AppInfo Service; a sc.exe or PowerShell process whose parent-process chain traces back through winver.exe or ComputerDefaults.exe rather than a normal interactive shell is not typical UAC-elevation behaviour and is the observable signature the mechanism supports.