Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 10:59
General
- Target zugauvc1jrg0d65l.exe
- Size 450KB
- Sample261027-m3tkvact8s
- SHA256 42c768756120b01d8c07e26aba5228204be7042a8f71bfa36ba7fb494766382e
Malware Config
Extracted
-
gomorat
-
110|Z9GkCWj9+34cV/7v4fkt5A==
-
109|gKa+Ij1RiPD8N5iw5GKYQw==
-
108|eSbxfBTyeQEaDxOzcRBX1IWZOihZzHB0IiR7f2sPIEM=
-
111|td6G05UztNnhqTLPv2rZYA==
-
antivirtual
127|iOb2tfEwoOBb1Gy02NunWQ==
-
certificate
126|nRXMwHI7uvu3l37+8ozUqA==
-
delay_unit
133|yGmjIG0Yetjk3ks/h9E0Ow==
-
delay_value
132|tNPjXj8dgbr3M/4h/KllFg==
-
disk_spread
136|h3P5LE8QiWrUKRSkan1N1A==
-
enable_delay
131|zwL3PYQyTeRj/AaFgioiAw==
-
exclusion_wd
115|zfS5oxcNwtVFbByG8S1DfA==
-
hidden_file
116|8a0rFgCjHmlcaOtCuLTW2w==
-
install
112|PJf1Jb1fo8MWNqL3RCpYZg==
-
install_watchdog
113|j83syYgU4JaXwMZeel55tg==
-
key
129|oGxKeNgz9TMczOgtieMxKg==
-
pastebin_url
130|mBnfnH5BjFv2Qu3xrmGmUA==
-
path_client
124|ndZl29UqJEp6904DZt6jvEmJx/Rl9gMlcec0O6t9HyI=
-
path_watchdog
125|g/8A6Vth2nZx1DUoMenxJQhTOqmEyMz8yNY7M62Bv9M=
-
pump
121|wtPbLAPWz8rf3HilsBlAkw==
-
rootkit
117|52frao/RQ3dyL1b+3PdFgw==
-
rootkit_type
134|nZlL0ii7Ze7aDZU0j7N46A==
-
task_client
122|3oQW9SILsbZjAwAl8BGJhQ==
-
task_watchdog
123|WqmwZnRQ1dG6I8BiNdkT1w==
-
usb_spread
135|WnYSNx53pl3RWD2N9XOYSQ==
-
use_install_admin
114|Xn+tOMkDCLXs3ugyZ7wZbg==
-
user_init
128|Dh4i+sf3BSa51z9/B+suQg==
-
winlogon_shell_enable
120|kIqWpJ07w19MOMDs+3DUHg==
-
wmi_name
119|nFaK8Y8EB2rslZTcGKsivw==
-
wmi_startup
118|kxvvmhWCSdHvvJfaqN+PUQ==
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\zugauvc1jrg0d65l.exe"C:\Users\Admin\AppData\Local\Temp\zugauvc1jrg0d65l.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|HayeVtFtD92ZcKEv3qf2N0AOmabBz7zVvEG/nV115tU11a3ZCY3dfCubl0kZIB0CWindowsControl472|LA1vnVX2e58HFX7w+2FNimhd7BSxTl0tmFMLvr4Ekdg=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/2088-277-0x00000163D60E0000-0x00000163D60E1000-memory.dmp
memory/2088-275-0x00000163D4AB0000-0x00000163D4AB1000-memory.dmp
memory/2088-267-0x00000163D48D0000-0x00000163D48D1000-memory.dmp
memory/2088-268-0x00000163D48D0000-0x00000163D48D1000-memory.dmp
memory/2088-269-0x00000163D4A80000-0x00000163D4A81000-memory.dmp
memory/2088-270-0x00000163D4A80000-0x00000163D4A81000-memory.dmp
memory/2088-271-0x00000163D4A90000-0x00000163D4A91000-memory.dmp
memory/2088-272-0x00000163D4A90000-0x00000163D4A91000-memory.dmp
memory/2088-537-0x00007FFDE2870000-0x00007FFDE2886000-memory.dmp
memory/2088-535-0x00007FFDE2870000-0x00007FFDE2886000-memory.dmp
memory/2088-273-0x00000163D4AA0000-0x00000163D4AA1000-memory.dmp
memory/2088-274-0x00000163D4AA0000-0x00000163D4AA1000-memory.dmp
memory/2088-276-0x00000163D4AB0000-0x00000163D4AB1000-memory.dmp
memory/2088-278-0x00000163D60E0000-0x00000163D60E1000-memory.dmp
memory/2624-536-0x00007FFDE2870000-0x00007FFDE2886000-memory.dmp
memory/2760-4-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-3-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-5-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-262-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-2-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-0-0x00000214A8260000-0x00000214A82D0000-memory.dmp
memory/2760-212-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-1-0x00007FFDCD7AF000-0x00007FFDCD7B0000-memory.dmp
memory/2760-6-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-8-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-27-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-7-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-12-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-11-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-10-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/2760-9-0x00007FFDCD620000-0x00007FFDCDFC4000-memory.dmp
memory/3156-307-0x0000023D801E0000-0x0000023D802E0000-memory.dmp
memory/3156-320-0x0000023D81A00000-0x0000023D81A20000-memory.dmp
memory/3156-354-0x0000023D94220000-0x0000023D94240000-memory.dmp
memory/3156-321-0x0000023D81E40000-0x0000023D81F40000-memory.dmp
memory/3156-340-0x0000023D81DE0000-0x0000023D81E00000-memory.dmp
memory/3836-534-0x00007FFDE2870000-0x00007FFDE2886000-memory.dmp
memory/3836-540-0x00007FFDE2870000-0x00007FFDE2886000-memory.dmp
memory/4748-52-0x0000024B02A20000-0x0000024B02A40000-memory.dmp
memory/4748-62-0x0000024B02D60000-0x0000024B02D80000-memory.dmp
memory/4748-88-0x0000024B14200000-0x0000024B14220000-memory.dmp
memory/4748-31-0x0000024B001E0000-0x0000024B002E0000-memory.dmp
memory/4748-53-0x0000024B02E40000-0x0000024B02F40000-memory.dmp
memory/4748-30-0x0000024B001E0000-0x0000024B002E0000-memory.dmp
memory/4748-29-0x0000024B001E0000-0x0000024B002E0000-memory.dmp
memory/5296-481-0x00007FFDE2870000-0x00007FFDE2886000-memory.dmp