Procedure examples

DarkWatchman can collect files from a compromised host.

DarkWatchman reports window names along with keylogger information to provide application context.

DarkWatchman can query the Registry to determine if it has already been installed on the system.

DarkWatchman has used the csc.exe tool to compile a C# executable.

DarkWatchman has used Base64 to encode PowerShell commands.

DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.

DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.

DarkWatchman has collected the username from a victim machine.

DarkWatchman has used an icon mimicking a text file to mask a malicious executable.

DarkWatchman can use WMI to execute commands.

DarkWatchman has created a scheduled task for persistence.

DarkWatchman can track key presses with a keylogger module.

DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger.

DarkWatchman can use `cmd.exe` to execute commands.

DarkWatchman uses JavaScript to perform its core functionalities.

DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.

DarkWatchman has been observed deleting its original launcher after installation.

DarkWatchman uses HTTPS for command and control.

DarkWatchman can stage local data in the Windows Registry.

DarkWatchman can collect the OS version, system architecture, and computer name.

DarkWatchman has the ability to enumerate file and folder names.

DarkWatchman can modify Registry values to store configuration strings, keylogger, and output of components.

DarkWatchman can list signed PnP drivers for smartcard readers.

DarkWatchman can collect time zone information and system `UPTIME`.

DarkWatchman can load DLLs.

DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.

DarkWatchman has the ability to self-extract as a RAR archive.

DarkWatchman can retrieve browser history.

DarkWatchman can delete shadow volumes using vssadmin.exe.

DarkWatchman can search for anti-virus products on the system.

DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.

DarkWatchman has used a DGA to generate a domain name for C2.

DarkWatchman can use TLS to encrypt its C2 channel.

DarkWatchman can identity the OS locale of a compromised host.