New stealthy DarkWatchman malware hides within the Home windows Registry

A brand new malware named ‘DarkWatchman’ has emerged within the cybercrime underground, and it is a light-weight and highly-capable JavaScript RAT (Distant Entry Trojan) paired with a C# keylogger.

In response to a technical report by researchers at Prevailion, the novel RAT is employed by Russian-speaking actors who goal primarily Russian organizations.

The primary indicators of DarkWatchman’s existence appeared in early November because the risk actor started distributing the malware via phishing emails with malicious ZIP attachments.

These ZIP file attachments include an executable utilizing an icon to impersonate a textual content doc. This executable is a self-installing WinRAR archive that can set up the RAT and keylogger.

If opened, the consumer is proven a decoy popup message that reads “Unknown Format,” however in actuality, the payloads have been put in within the background.

A stealthy ‘file-less’ RAT

DarkWatchman is a really gentle malware, with the JavaScript RAT measuring simply 32kb in measurement and the compiled solely taking utilizing 8.5kb of house.

It makes use of a big set of “residing off the land” binaries, scripts, and libraries, and incorporates stealthy strategies to switch information between modules.

The fascinating facet of DarkWatchman is its use of the Home windows Registry fileless storage mechanism for the keylogger. 

As a substitute of storing the keylogger on disk, a scheduled activity is created to launch the DarkWatchman RAT each time the consumer logs into Home windows.

As soon as launched, DarkWatchmen will execute a PowerShell script that compiles the keylogger utilizing the .NET CSC.exe command and launches it into reminiscence.

“The keylogger is distributed as obfuscated C# supply code that’s processed and saved within the registry as a Base64-encoded PowerShell command. When the RAT is launched, it executes this PowerShell script which, in flip, compiles the keylogger (utilizing CSC) and executes it,” Prevailion researchers Matt Stafford and Sherman Smith defined of their report.

“The keylogger itself doesn’t talk with the C2 or write to disk. As a substitute, it writes its keylog to a registry key that it makes use of as a buffer. Throughout its operation, the RAT scrapes and clears this buffer earlier than transmitting the logged keystrokes to the C2 server.”

As such, the registry just isn’t solely used as a spot to cover the encoded executable code, but additionally as a short lived location to carry stolen information till it’s exfiltrated to the C2.

When it comes to the C2 communication and infrastructure, the DarkWatchman actors use DGA (area technology algorithms) with a seeded listing of 10 gadgets to generate as much as 500 domains day by day.

This provides them wonderful operational resilience, and on the similar time, makes communication monitoring and evaluation very difficult.

DarkWatchman’s practical capabilities are the next:

• Execute EXE recordsdata (with or with out the output returned)
• Load DLL recordsdata
• Execute instructions on the command line
• Execute WSH instructions
• Execute miscellaneous instructions by way of WMI
• Execute PowerShell instructions
• Consider JavaScript
• Add recordsdata to the C2 server from the sufferer machine
• Remotely cease and uninstall the RAT and Keylogger
• Remotely replace the C2 server handle or call-home timeout
• Replace the RAT and Keylogger remotely
• Set an autostart JavaScript to run on RAT startup
• A Area Technology Algorithm (DGA) for C2 resiliency
• If the consumer has admin permissions, it deletes shadow copies utilizing vssadmin.exe

The ransomware speculation

Prevailion theorizes that DarkWatchman could also be tailor-made by/for ransomware teams that have to empower their much less succesful associates with a potent and stealthy software.

The malware can load extra payloads remotely, so it may very well be used as a stealthy first-stage an infection for subsequent ransomware deployment.

Since DarkWatchman can talk to actor-controlled domains after the preliminary foothold, the ransomware operator may take over and deploy the ransomware or deal with the file exfiltration straight.

This strategy would degrade the affiliate’s position to that of a community infiltrator and concurrently make RaaS operations extra medical and environment friendly.