Analysis
- max time kernel
16s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 22:51
General
- Target 92j2fepitfu3tfj3.exe
- Size 349KB
- Sample261027-2s4qdsxtdw
- SHA256 91668c96c3491a99c371d6c4bcc9e792ddb6dd8888afdb75df856d935da7ff25
Malware Config
Extracted
-
gomorat
-
110|8ymAqlentBUZJCFtxhuP9g==
-
109|lgaAF72ipvpYiZ74aBv27g==
-
108|uP+cImGGSs1ZT/NBSMYXQQMMfhfcsQGUrmT8krG06WM=
-
111|PsAqkDG4JKMguZHJwec2fQ==
-
antivirtual
127|9bq0r7nIbSSDEZxL8+NFbQ==
-
certificate
126|96Aeex0O0k/YUhkTP9Poxg8+U9fUNdq8sv0whhejtpg=
-
delay_unit
133|KTJ84Eln7a/dm7aFwEGnGg==
-
delay_value
132|ISCyZ0VY45sewHqEUahpNQ==
-
disk_spread
136|Z1y4CfgbWy4AVGTK7uHxng==
-
enable_delay
131|dCEpJSF+40djSBsP/zwmxg==
-
exclusion_wd
115|VrSTuINU5nTjgedcjDgkjw==
-
hidden_file
116|Y+uBkjnN/+1Z3VMdGUdamQ==
-
install
112|Stwv8RWsTe3JOwrnEvtfHw==
-
install_watchdog
113|FX4jC68REr2WnkKEQSqfsQ==
-
key
129|aR6jiswosU1Wuhwb0+vXOHjy9VJEBuVZaiZJKfJGxIM=
-
pastebin_url
130|9NoWD77QNDyUiD0LkQdniQ==
-
path_client
124|/rgYC4/as+tqYyeFDz/A6bR9kIeaNCcD/ZsDLdrAajs=
-
path_watchdog
125|ZHO+BiNPuyeTiQ6VttKNCiPthMnscM+QuA+VZBKZRMY=
-
pump
121|0cwgjEMTSUNMknB8mTDUUA==
-
rootkit
117|r0FpryNLJ4Z3TZz7g8cAL2fLfgKk41BVNsykdNEMUQA=
-
rootkit_type
134|qANZkWwPUvbcmz/B6/zBJQ==
-
task_client
122|n368ooQn8gmQ2Mr7CUNLlQ==
-
task_watchdog
123|PscG8hMCQc62eDmG7xYRpw==
-
usb_spread
135|wzGev4/mfjFOkrTkAjg8Xg==
-
use_install_admin
114|wyLrfb4J34lfTyvmEp9HxA==
-
user_init
128|IJ6obc50Swl3TSGJev3FQQ==
-
winlogon_shell_enable
120|VER4129pp4AKEihOK6eHfw==
-
wmi_name
119|b3zOMUUlK94UNfNaJpbPEw==
-
wmi_startup
118|hQbF0CDOnfQhaqrs0JyL1g==
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\92j2fepitfu3tfj3.exe"C:\Users\Admin\AppData\Local\Temp\92j2fepitfu3tfj3.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|iqRuOmNYyweIMUJTLNXwcOC9DS/eOtJJbZagy5BhvJCKEtq44iJjt+ldnblrhSXsWindowsControl472|66gn4vO/mp/+20XcziDb6hkb8/pgo0DUFHtfSiqNoKM=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/952-500-0x00007FF9C7CB0000-0x00007FF9C7CC6000-memory.dmp
memory/952-502-0x00007FF9C7CB0000-0x00007FF9C7CC6000-memory.dmp
memory/2248-8-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-34-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-11-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-10-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-27-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-28-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-29-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-30-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-31-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-32-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-33-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-12-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-35-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-9-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-0-0x0000024C0E9F0000-0x0000024C0EA4C000-memory.dmp
memory/2248-7-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-6-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-5-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-4-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-3-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-2-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-256-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp
memory/2248-1-0x00007FF9B2B8F000-0x00007FF9B2B90000-memory.dmp
memory/2464-262-0x000001BFC2560000-0x000001BFC2561000-memory.dmp
memory/2464-272-0x000001BFC25B0000-0x000001BFC25B1000-memory.dmp
memory/2464-270-0x000001BFC25A0000-0x000001BFC25A1000-memory.dmp
memory/2464-269-0x000001BFC2590000-0x000001BFC2591000-memory.dmp
memory/2464-268-0x000001BFC2590000-0x000001BFC2591000-memory.dmp
memory/2464-267-0x000001BFC2580000-0x000001BFC2581000-memory.dmp
memory/2464-266-0x000001BFC2580000-0x000001BFC2581000-memory.dmp
memory/2464-264-0x000001BFC2570000-0x000001BFC2571000-memory.dmp
memory/2464-263-0x000001BFC2560000-0x000001BFC2561000-memory.dmp
memory/2464-273-0x000001BFC25B0000-0x000001BFC25B1000-memory.dmp
memory/2464-265-0x000001BFC2570000-0x000001BFC2571000-memory.dmp
memory/2464-499-0x00007FF9C7CB0000-0x00007FF9C7CC6000-memory.dmp
memory/2464-505-0x00007FF9C7CB0000-0x00007FF9C7CC6000-memory.dmp
memory/2464-271-0x000001BFC25A0000-0x000001BFC25A1000-memory.dmp
memory/3236-456-0x00007FF9C7CB0000-0x00007FF9C7CC6000-memory.dmp
memory/3460-501-0x00007FF9C7CB0000-0x00007FF9C7CC6000-memory.dmp
memory/3560-321-0x00000171001E0000-0x00000171002E0000-memory.dmp
memory/3560-368-0x0000017114240000-0x0000017114260000-memory.dmp
memory/3560-354-0x00000171142C0000-0x00000171142E0000-memory.dmp
memory/3560-336-0x0000017113E40000-0x0000017113F40000-memory.dmp
memory/3560-334-0x0000017103B60000-0x0000017103B80000-memory.dmp
memory/4284-102-0x000002AE846D0000-0x000002AE846F0000-memory.dmp
memory/4284-72-0x000002AE83F60000-0x000002AE84060000-memory.dmp
memory/4284-80-0x000002AE83D10000-0x000002AE83D30000-memory.dmp
memory/4284-70-0x000002AE83A20000-0x000002AE83A40000-memory.dmp
memory/4284-56-0x000002AE801E0000-0x000002AE802E0000-memory.dmp