Analysis
- max time kernel
12s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 22:46
General
- Target bu09o1kyzsoiehvd.exe
- Size 908KB
- Sample261027-2pxgxavy8p
- SHA256 aa9e6594aae8bd6f487bfcbb8007c2a0f7e5bc7262e088ff6b031f7432d9107a
Malware Config
Extracted
-
gomorat
-
1.8
-
t.me/junk_code
-
130.49.213.211:20780
-
@junk_code
-
antivirtual
false
-
certificate
d0aloh74q1w6raord7df7bqhay
-
delay_unit
Hours
-
delay_value
420
-
disk_spread
false
-
enable_delay
false
-
exclusion_wd
true
-
hidden_file
true
-
install
true
-
install_watchdog
true
-
key
kfket6kwphhvkc32s3tqlps6neg
-
path_client
%ProgramFiles%\junkSearch.exe
-
path_watchdog
%Windows%\junkSearcher.exe
-
pump
false
-
rootkit
uteygwkadzze2b0
-
rootkit_type
junkkit
-
task_client
ShellHost
-
task_watchdog
CookieManager
-
usb_spread
true
-
use_install_admin
true
-
user_init
true
-
winlogon_shell_enable
true
-
wmi_name
WindowsDefender
-
wmi_startup
true
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bu09o1kyzsoiehvd.exe"C:\Users\Admin\AppData\Local\Temp\bu09o1kyzsoiehvd.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|4RbKU92Mt7FT0dWIz+SW/M11GjPfH8sSEJo3YUuDUhRBZMyWVd9fEzFJLHnPRlYIWindowsControl472|cOJcyicD1CU1eAy0Oio/mSL5z2g+BEv2GY/S2+4cfYs=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/1296-525-0x00007FFFA2930000-0x00007FFFA2946000-memory.dmp
memory/1296-522-0x00007FFFA2930000-0x00007FFFA2946000-memory.dmp
memory/2308-523-0x00007FFFA2930000-0x00007FFFA2946000-memory.dmp
memory/2448-257-0x000000000B380000-0x000000000B3F9000-memory.dmp
memory/3924-329-0x00000211818C0000-0x00000211818E0000-memory.dmp
memory/3924-336-0x0000021181B20000-0x0000021181B40000-memory.dmp
memory/3924-305-0x00000211801E0000-0x00000211802E0000-memory.dmp
memory/3924-330-0x0000021181D00000-0x0000021181E00000-memory.dmp
memory/3924-303-0x00000211801E0000-0x00000211802E0000-memory.dmp
memory/3924-350-0x00000211940A0000-0x00000211940C0000-memory.dmp
memory/3924-304-0x00000211801E0000-0x00000211802E0000-memory.dmp
memory/4852-524-0x0000020B998F0000-0x0000020B99A66000-memory.dmp
memory/4984-266-0x0000019CFC590000-0x0000019CFC591000-memory.dmp
memory/4984-269-0x0000019CFC5B0000-0x0000019CFC5B1000-memory.dmp
memory/4984-521-0x00007FFFA2930000-0x00007FFFA2946000-memory.dmp
memory/4984-267-0x0000019CFC5A0000-0x0000019CFC5A1000-memory.dmp
memory/4984-270-0x0000019CFC5B0000-0x0000019CFC5B1000-memory.dmp
memory/4984-271-0x0000019CFC5C0000-0x0000019CFC5C1000-memory.dmp
memory/4984-272-0x0000019CFC5C0000-0x0000019CFC5C1000-memory.dmp
memory/4984-268-0x0000019CFC5A0000-0x0000019CFC5A1000-memory.dmp
memory/4984-273-0x0000019CFC5D0000-0x0000019CFC5D1000-memory.dmp
memory/4984-265-0x0000019CFC590000-0x0000019CFC591000-memory.dmp
memory/4984-276-0x0000019CFC5E0000-0x0000019CFC5E1000-memory.dmp
memory/4984-275-0x0000019CFC5E0000-0x0000019CFC5E1000-memory.dmp
memory/4984-274-0x0000019CFC5D0000-0x0000019CFC5D1000-memory.dmp
memory/5212-95-0x000001A6946F0000-0x000001A694710000-memory.dmp
memory/5212-49-0x000001A6801E0000-0x000001A6802E0000-memory.dmp
memory/5212-63-0x000001A682E70000-0x000001A682F70000-memory.dmp
memory/5212-81-0x000001A682C70000-0x000001A682C90000-memory.dmp
memory/5212-61-0x000001A682A10000-0x000001A682A30000-memory.dmp
memory/5576-505-0x00007FFFA2930000-0x00007FFFA2946000-memory.dmp
memory/6120-11-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-6-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-27-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-12-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-0-0x00007FFF8BA6F000-0x00007FFF8BA70000-memory.dmp
memory/6120-10-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-9-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-7-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-8-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-46-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-212-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-5-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-258-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-4-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-3-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-2-0x00007FFF8B8E0000-0x00007FFF8C284000-memory.dmp
memory/6120-1-0x000001FBB99A0000-0x000001FBB9A86000-memory.dmp