Loading malware…
DarkWatchman is a modular Windows remote access trojan first observed in 2021 and associated with the Hive0117 intrusion set. Its core backdoor is implemented in JavaScript, with PowerShell used for command execution and keylogger deployment. It enables remote control, collection of sensitive information, and delivery of additional modules. Its registry-centric, fileless-style architecture stores configuration, encoded keylogger code, component output, and captured data in the Windows Registry, although installation chains can include files written to disk.
DarkWatchman captures keystrokes and clipboard contents, collects system and user information, identifies installed antivirus products, and enumerates smart-card readers and cryptographic-token activity. The backdoor retrieves staged data from the Registry and exfiltrates it to command-and-control infrastructure. It supports hexadecimal encoding of outbound data, TLS-protected communications, and domain-generation-based fallback infrastructure. Observed installations establish persistence through scheduled tasks and execute scripts through Windows Script Host and Windows Management Instrumentation. Defense-evasion behaviors include code obfuscation, encrypted payload storage, compilation of C# components on the victim system, document-style executable icons, Windows Defender exclusions, and deletion of installation artifacts. Some variants also clear browser history and delete volume shadow copies when sufficient privileges are available.
Distribution includes accounting-themed phishing and spearphishing emails carrying password-protected archives with executables disguised as documents, as well as an impersonated CryptoPro CSP download website. Hive0117 has used DarkWatchman against corporate accountants and financial departments, particularly in Russia, to facilitate unauthorized access to remote banking systems and financial theft. Associated campaigns have also affected organizations in Belarus, Kazakhstan, and Uzbekistan. DarkWatchman has additionally been deployed against Russian aerospace organizations.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The FMVT RAT DGA-domain length matches domains generated by DarkWatchman; Hive0117 had previously used the fileless DarkWatchman malware.
DarkWatchman is described as Hive0117's principal tool: a fileless modular JavaScript- and PowerShell-based trojan that resides in the Windows Registry and memory, with no executable payload files on disk. It uses Bitcoin OP_RETURN data as a dead-drop resolver for rotating C2 URLs.
DarkWatchman is described as Hive0117's principal tool: a fileless modular JavaScript- and PowerShell-based trojan that resides in the Windows Registry and memory, with no executable payload files on disk. It uses Bitcoin OP_RETURN data as a dead-drop resolver for rotating C2 URLs.
DarkWatchman is described as Hive0117's principal tool: a fileless modular JavaScript- and PowerShell-based trojan that resides in the Windows Registry and memory, with no executable payload files on disk. It uses Bitcoin OP_RETURN data as a dead-drop resolver for rotating C2 URLs.
65 distinct techniques documented for this family, organized by ATT&CK tactic.
Volt Typhoon has obtained the victim's system current location.
ID T1608.001 Obtain Capabilities: Malware
With control of an accountant’s machine, attackers could log into corporate online banking portals and initiate transactions directly from the compromised system, making the activity appear legitimate.
Cyble Research and Intelligence Labs (CRIL) have identified a phishing website that imitated a renowned Russian website, CryptoPro CSP. TAs were using this website to distribute DarkWatchman malware.
[DarkWatchman](https://attack.mitre.org/software/S0673) has been delivered via spearphishing emails that contain a malicious zip file.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can use WMI to execute commands.(Citation: Prevailion DarkWatchman 2021)
the script then proceeds to create a task scheduler entry in the system that will run the copied script every time the system starts up.
[DarkWatchman](https://attack.mitre.org/software/S0673) has created a scheduled task for persistence.(Citation: Prevailion DarkWatchman 2021)
Subsequently, it runs the JavaScript file with the following two commands in sequence via the command prompt... powershell.exe ... Add-MpPreference ... & ... wscript.exe /E:jscript 144039266 131
[DarkWatchman](https://attack.mitre.org/software/S0673) can execute PowerShell commands and has used PowerShell to execute a keylogger.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can use `cmd.exe` to execute commands.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) uses JavaScript to perform its core functionalities.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can load DLLs.(Citation: Prevailion DarkWatchman 2021)
Upon extraction, the malicious archive includes two files, CSPSetup.exe, and readme.txt. If executed, CSPSetup.exe installs the DarkWatchman malware.
Once launched, the LNK executes PowerShell commands... A RAR archive was attached to the email, containing a BATCH script file.
...uses the LoadLibraryExW() function to load additional modules... execute additional plugins by loading the respective DLLs... loaded and executed DLLs in memory during runtime... loads a dynamic library (.dylib file) using dlopen() and obtains a function pointer... using dlopen() and dlsym()... calls LoadLibrary then executes exports from a DLL.
the script then proceeds to create a task scheduler entry in the system that will run the copied script every time the system starts up.
[DarkWatchman](https://attack.mitre.org/software/S0673) has created a scheduled task for persistence.(Citation: Prevailion DarkWatchman 2021)
With control of an accountant’s machine, attackers could log into corporate online banking portals and initiate transactions directly from the compromised system, making the activity appear legitimate.
[DarkWatchman](https://attack.mitre.org/software/S0673) can modify Registry values to store configuration strings, keylogger, and output of components.(Citation: Prevailion DarkWatchman 2021)
the script then proceeds to create a task scheduler entry in the system that will run the copied script every time the system starts up.
[DarkWatchman](https://attack.mitre.org/software/S0673) has created a scheduled task for persistence.(Citation: Prevailion DarkWatchman 2021)
Загружаемые модули используют инъекцию в легитимные процессы.
With control of an accountant’s machine, attackers could log into corporate online banking portals and initiate transactions directly from the compromised system, making the activity appear legitimate.
Обфускация затрудняет статический анализ; encoded-команды передаются через -encodedcommand.
[DarkWatchman](https://attack.mitre.org/software/S0673) has used the <code>csc.exe</code> tool to compile a C# executable.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) has used Base64 to encode PowerShell commands.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can store configuration strings, keylogger, and output of components in the Registry.(Citation: Prevailion DarkWatchman 2021)
"Bumblebee has been delivered as password-protected zipped ISO files" / "Flagpro has been delivered within ZIP or RAR password-protected archived files." / "TA505 has password-protected malicious Word documents."
[DarkWatchman](https://attack.mitre.org/software/S0673) has been delivered as compressed RAR payloads in ZIP files to victims.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) has used an icon mimicking a text file to mask a malicious executable.(Citation: Prevailion DarkWatchman 2021)
Загружаемые модули используют инъекцию в легитимные процессы.
[DarkWatchman](https://attack.mitre.org/software/S0673) can uninstall malicious components from the Registry, stop processes, and clear the browser history.(Citation: Prevailion DarkWatchman 2021)
DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.
[DarkWatchman](https://attack.mitre.org/software/S0673) has been observed deleting its original launcher after installation.(Citation: Prevailion DarkWatchman 2021)
CSPY Downloader has the ability to remove values it writes to the Registry.
With control of an accountant’s machine, attackers could log into corporate online banking portals and initiate transactions directly from the compromised system, making the activity appear legitimate.
[DarkWatchman](https://attack.mitre.org/software/S0673) has the ability to self-extract as a RAR archive.(Citation: Prevailion DarkWatchman 2021)
the RAT proceeds to execute a system command to delete all the restore points... Next, the function registers the “dynwrapx.dll” library by copying it to the %temp% directory and running the “regsvr32.exe” command with the “/i” and “/s” flags to install the library silently.
DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.
powershell.exe -NonI -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath “C:”
...uses the LoadLibraryExW() function to load additional modules... execute additional plugins by loading the respective DLLs... loaded and executed DLLs in memory during runtime... loads a dynamic library (.dylib file) using dlopen() and obtains a function pointer... using dlopen() and dlsym()... calls LoadLibrary then executes exports from a DLL.
[DarkWatchman](https://attack.mitre.org/software/S0673) can modify Registry values to store configuration strings, keylogger, and output of components.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can track key presses with a keylogger module.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) reports window names along with keylogger information to provide application context.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can query the Registry to determine if it has already been installed on the system.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) has collected the username from a victim machine.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can collect the OS version, system architecture, and computer name.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) has the ability to enumerate file and folder names.(Citation: Prevailion DarkWatchman 2021)
After that, the RAT collects the victim’s system information, such as operating system version, locale, computer name, username, domain role, and antivirus software.
[DarkWatchman](https://attack.mitre.org/software/S0673) can list signed PnP drivers for smartcard readers.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can collect time zone information and system `UPTIME`.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can retrieve browser history.(Citation: Prevailion DarkWatchman 2021)
DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.
[DarkWatchman](https://attack.mitre.org/software/S0673) can search for anti-virus products on the system.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can identity the OS locale of a compromised host.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can collect files from a compromised host.(Citation: Prevailion DarkWatchman 2021)
[DarkWatchman](https://attack.mitre.org/software/S0673) can track key presses with a keylogger module.(Citation: Prevailion DarkWatchman 2021)
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
[DarkWatchman](https://attack.mitre.org/software/S0673) can stage local data in the Windows Registry.(Citation: Prevailion DarkWatchman 2021)
Установка кейлоггера - перехват ввода с клавиатуры и буфера обмена.
A self-extracting archive (SFX) installer drops two files: a JS file and a file containing a blob of hexadecimal characters.
При этом пароль от архива указывался прямо в теле письма, что помогает обходить почтовые фильтры и антивирусные проверки.
Next, the function attempts to connect to a C&C URL retrieved from the registry key uid + ‘c’... After gathering the captured stolen information, the RAT sends it to the C&C server.
[DarkWatchman](https://attack.mitre.org/software/S0673) uses HTTPS for command and control.(Citation: Prevailion DarkWatchman 2021)
The script queries mempool.space or blockstream.info transaction history, extracts OP_RETURN data, decodes it, and obtains the current C2 URL.
DarkWatchman gives attackers the ability to... download additional malicious tools...
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
[DarkWatchman](https://attack.mitre.org/software/S0673) encodes data using hexadecimal representation before sending it to the C2 server.(Citation: Prevailion DarkWatchman 2021)
Как только бухгалтер вставляет токен, злоумышленники через средство удалённого администрирования перехватывают контроль над экраном и активной сессией.
[DarkWatchman](https://attack.mitre.org/software/S0673) has used a DGA to generate a domain name for C2.(Citation: Prevailion DarkWatchman 2021)
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
[DarkWatchman](https://attack.mitre.org/software/S0673) can use TLS to encrypt its C2 channel.(Citation: Prevailion DarkWatchman 2021)
According to IBM’s X-Force, the malware collects system information and generates a beacon that will transmit the following information to the C2... An initial HTTP POST request is sent to the server's '/register' endpoint, transmitting the gathered system information.
[DarkWatchman](https://attack.mitre.org/software/S0673) can delete shadow volumes using <code>vssadmin.exe</code>.(Citation: Prevailion DarkWatchman 2021)
ComRAT has modified Registry values to store encrypted orchestrator code and payloads ... QakBot can modify the Registry to store its configuration information ... Volgmer modifies the Registry to store an encoded configuration file ...
The group forms payment orders disguised as salary payments to accounts controlled by money mules.
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
76 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.