Darkmoon

Overview

Backdoor:Win32/Darkmoon (frequently associated with the commercial penetration testing framework Core Impact) is a highly sophisticated Remote Access Trojan (RAT) and post-exploitation agent. While Core Impact is a legitimate tool used by security professionals (similar to Cobalt Strike), threat actors often pirate or re-purpose its agents (like Darkmoon) to establish deep, stealthy control over compromised enterprise networks (`T1219`).

Understanding Darkmoon (Advanced Backdoors)
To an end-user, Darkmoon is completely invisible. For a security operations center (SOC), the detection of Darkmoon is a critical incident indicating that an advanced adversary has already bypassed perimeter defenses and achieved execution on a high-value asset. It is not an initial access vector; it is a tool for lateral movement and long-term espionage.

Execution and Post-Exploitation Mechanics
Darkmoon is usually deployed after an initial breach (e.g., via spearphishing or exploiting an edge service). It is designed to be highly modular and evasive. It operates entirely in memory (`T1055`), injecting itself into legitimate system processes to avoid writing a detectable executable to the hard drive. It utilizes encrypted command and control channels (often HTTPS or custom DNS tunneling) to blend in with normal enterprise traffic (`T1071.001`). From this foothold, the attacker uses Darkmoon to dump credentials (`T1003`), map the network infrastructure (`T1046`), and deploy further implants or ransomware.

Indicators of Compromise & Impact
The impact is total loss of confidentiality and control over the infected host. Host-based IoCs are extremely subtle due to the memory-only execution; EDR solutions may detect anomalous process injection (e.g., `CreateRemoteThread`) or unexpected network connections originating from processes like `svchost.exe` or `lsass.exe`. Network IoCs involve regular beaconing behavior to unknown IP addresses or domains with unusually high entropy.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_DARKMOON_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Darkmoon"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "darkmoon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Darkmoon (Ransomware) Execution & Triage
id: 55d57169-4ff4-5535-b653-a9a79d3175ee
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Darkmoon malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/darkmoon
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1003
- attack.t1219
- attack.t1046
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_DARKMOON_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Darkmoon tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "darkmoon" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Do NOT immediately power off or reboot the machine, as Darkmoon may be running entirely in RAM; capture a live memory image first.
2. Isolate the host from the network at the switch level to sever the C2 connection while preserving evidence.
3. Conduct a full Active Directory audit, assuming that any credentials used on or by the infected machine have been compromised.
4. Hunt across the enterprise network for the C2 IP addresses or domains identified during memory analysis.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on standard antivirus scans to clear a Darkmoon infection; they will almost certainly fail to detect the in-memory payload.
2. Avoid resetting passwords from the infected machine, as the attacker likely has active keylogging modules deployed.

References & External Analysis

• Search "darkmoon" on VirusTotal (External Analysis)
• Search "darkmoon" on Any.Run (Sandbox Sandbox)
• Search "darkmoon" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Wraut
• Redosdru
• Tescrypt
• Pandex
• Tanske
• Cognosads
• Redneck
• Ilomo

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/darkmoon.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.