“Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing

MITRE Techniques

• [T1204.002 ] User Execution: Malicious File – The infection begins when the user opens an invoice disguised as a file attachment in email (‘an invoice sent via email’ and ‘believing it to be a PDF document’).
• [T1574.001 ] DLL Side-Loading – MoiClient executes by loading malicious uxtheme.Dll alongside a legitimate SumatraPDF executable (‘uxtheme.Dll… is loaded via DLL side-loading, thereby executing MoiClient’).
• [T1055 ] Process Injection – It injects shellcode into explorer.exe and loads the final payload in memory (‘Inserting shellcode… into the entry point… Loads and executes the final payload in memory’).
• [T1055.012 ] Process Hollowing – A suspended explorer.exe process is created and its entry point is overwritten with shellcode (‘Creation of an explorer.Exe process in the “Suspended” state’ and ‘EP Overwrite’).
• [T1548.002 ] Abuse Elevation Control Mechanism: Bypass User Account Control – It abuses the AppInfo RPC path and ComputerDefaults.exe to obtain elevated privileges (‘executes ComputerDefaults.Exe… and receives the associated debug events’ and ‘allowing them to bypass UAC’).
• [T1021.003 ] Remote Services: Windows Remote Management / RPC – The malware connects to the AppInfo Service using ncalrpc and the RPC interface to perform UAC bypass (‘uses the ncalrpc protocol sequence to connect to the RPC interface of the AppInfo Service’).
• [T1068 ] Exploitation for Privilege Escalation – It leverages system components and vulnerable driver behavior to gain elevated control (‘uses the BYOVD technique’ and ‘vulnerable driver in Lenovo PC Manager’).
• [T1068 ] Exploitation for Privilege Escalation – It abuses the BootRepair.Sys vulnerable driver to terminate security processes (‘passes the corresponding PID to the \.BootRepair device to terminate them’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – It targets Windows Defender and other security products to reduce detection (‘neutralize security products’ and ‘attempt to disable Windows Defender’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Persistence is achieved through a scheduled task that relaunches the malware every 30 minutes (‘registers a Task Scheduler job’ and ‘The registered task runs every 30 minutes’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – The malware creates a recurring Task Scheduler job to reload itself (‘creates a job name’ and ‘runs every 30 minutes’).
• [T1105 ] Ingress Tool Transfer – It downloads additional payloads and tools from the C2 server (‘downloads an additional payload’ and ‘downloads defendnot.DLL and defendnot-loader.Exe’).
• [T1027 ] Obfuscated Files or Information – It hides related files and disguises components as benign-looking names and extensions (‘all other files are marked as hidden’ and ‘disguised as an invoice’).
• [T1106 ] Native API – It uses CreateThread() to execute the downloaded payload in memory (‘executed in memory using CreateThread()’).