Analysis
- max time kernel
11s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 22:17
General
- Target x0rzt3xvvkym95v2.exe
- Size 812KB
- Sample261027-17vklavy2m
- SHA256 c353b1f765129c0bfcb1f9826d993093175a0b32456d34028e122175773d1d3d
Malware Config
Extracted
-
gomorat
-
1.8
-
t.me/junk_code
-
130.49.213.211:20811
-
@junk_code
-
antivirtual
false
-
certificate
a6xyahzwffyn0
-
delay_unit
Hours
-
delay_value
420
-
disk_spread
false
-
enable_delay
false
-
exclusion_wd
true
-
hidden_file
true
-
install
true
-
install_watchdog
true
-
key
0myuvc3vuwzqdv1
-
path_client
%ProgramFiles%\junkSearch.exe
-
path_watchdog
%Windows%\junkSearcher.exe
-
pump
false
-
rootkit
7yoa2b5nda4nsvg
-
rootkit_type
junkkit
-
task_client
ShellHost
-
task_watchdog
CookieManager
-
usb_spread
true
-
use_install_admin
true
-
user_init
true
-
winlogon_shell_enable
true
-
wmi_name
WindowsDefender
-
wmi_startup
true
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x0rzt3xvvkym95v2.exe"C:\Users\Admin\AppData\Local\Temp\x0rzt3xvvkym95v2.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|k65uYzl+WBZ/PR/gv8yAwbCR8MRj9OfkmjM6mIiR79h0E1bXX3DjSl2tI6T9vyXkWindowsControl472|3yUvBscD9xGMLyed3BHSlLaR+XL/fUiOn2eSXpS0CsY=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/200-509-0x00007FFC06F40000-0x00007FFC06F56000-memory.dmp
memory/912-259-0x000001C616440000-0x000001C61653F000-memory.dmp
memory/2032-49-0x000001D2001E0000-0x000001D2002E0000-memory.dmp
memory/2032-81-0x000001D203A80000-0x000001D203AA0000-memory.dmp
memory/2032-95-0x000001D2140E0000-0x000001D214100000-memory.dmp
memory/2032-60-0x000001D203A60000-0x000001D203A80000-memory.dmp
memory/2032-61-0x000001D213D40000-0x000001D213E40000-memory.dmp
memory/2492-504-0x00007FFC06F40000-0x00007FFC06F56000-memory.dmp
memory/2752-510-0x00000266E44D0000-0x00000266E45CF000-memory.dmp
memory/4516-523-0x000001906D2C0000-0x000001906D2EA000-memory.dmp
memory/4516-520-0x000001906CF50000-0x000001906CFC8000-memory.dmp
memory/4516-524-0x000001906D2F0000-0x000001906D33A000-memory.dmp
memory/4516-522-0x000001906D270000-0x000001906D2BC000-memory.dmp
memory/4656-337-0x000001EA02DA0000-0x000001EA02DC0000-memory.dmp
memory/4656-305-0x000001EA001E0000-0x000001EA002E0000-memory.dmp
memory/4656-319-0x000001EA029C0000-0x000001EA029E0000-memory.dmp
memory/4656-320-0x000001EA02E20000-0x000001EA02F20000-memory.dmp
memory/4656-351-0x000001EA14220000-0x000001EA14240000-memory.dmp
memory/4836-274-0x0000019FEC330000-0x0000019FEC331000-memory.dmp
memory/4836-267-0x0000019FEC2F0000-0x0000019FEC2F1000-memory.dmp
memory/4836-277-0x0000019FEC340000-0x0000019FEC341000-memory.dmp
memory/4836-276-0x0000019FEC340000-0x0000019FEC341000-memory.dmp
memory/4836-275-0x0000019FEC330000-0x0000019FEC331000-memory.dmp
memory/4836-514-0x00007FFC06F40000-0x00007FFC06F56000-memory.dmp
memory/4836-273-0x0000019FEC320000-0x0000019FEC321000-memory.dmp
memory/4836-272-0x0000019FEC320000-0x0000019FEC321000-memory.dmp
memory/4836-271-0x0000019FEC310000-0x0000019FEC311000-memory.dmp
memory/4836-270-0x0000019FEC310000-0x0000019FEC311000-memory.dmp
memory/4836-269-0x0000019FEC300000-0x0000019FEC301000-memory.dmp
memory/4836-268-0x0000019FEC300000-0x0000019FEC301000-memory.dmp
memory/4836-266-0x0000019FEC2F0000-0x0000019FEC2F1000-memory.dmp
memory/4836-508-0x00007FFC06F40000-0x00007FFC06F56000-memory.dmp
memory/4868-258-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-48-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-1-0x00000238412B0000-0x000002384137E000-memory.dmp
memory/4868-10-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-27-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-213-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-9-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-8-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-7-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-0-0x00007FFBF1F4F000-0x00007FFBF1F50000-memory.dmp
memory/4868-6-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-11-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-5-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-12-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-4-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-3-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/4868-2-0x00007FFBF1DC0000-0x00007FFBF2764000-memory.dmp
memory/5252-507-0x00007FFC06F40000-0x00007FFC06F56000-memory.dmp