Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 10:20
General
- Target v09hlsq24iwrk0iw.exe
- Size 368KB
- Sample261027-mdarfazy9r
- SHA256 4792f0f0878b64a10ca1bbdc4fa8c6737caa9594dbc35f46f8f35a1da8f85b10
Malware Config
Extracted
-
gomorat
-
110|EOSaFCbyO6cKdfmj7u4nwA==
-
109|0/szb2sSLw4oRwZLcfoRpg==
-
111|FfA2fLd1Yjf+adZFu7OFKg==
-
antivirtual
127|QD4lQRlw49SvREpnNqmlnA==
-
certificate
126|ZCqiUmHgz0ussB89ZYB0xw==
-
delay_unit
133|Th7sdUsvIss0NDt++vtvgw==
-
delay_value
132|KvoxTOA1mZLrT60i1Oxn9g==
-
disk_spread
136|Fn3O+YTEMONfc2y1sYk2OA==
-
enable_delay
131|u5a5iCADeEw4+qJ8Shtt8Q==
-
exclusion_wd
115|v3aFjH0iihT+Go3nsKemgQ==
-
hidden_file
116|s7B8B6uKM2rC2zZvMAdduw==
-
install
112|gpBSw9XbqRtcLkGjvTVnuw==
-
install_watchdog
113|vot5HTm3hwn39G19K8vtcw==
-
key
129|FEeD4+j3EEmXieSXEafuWCWqpWhdVDvtOsXnU4zhSKw=
-
pastebin_url
130|UB+K1mxBB7QMvGKMoBIBqQ==
-
path_client
124|hKJGtr0O5KDxdzv/8OFqg/mLh6ZF7+4e2E34yULBISU=
-
path_watchdog
125|zeGFaxBymPRfumYyx6qRkiek39x7Smg2ydSAdZjPUt4=
-
pump
121|gnfeYOhA0d+DCSFzsacQ4A==
-
rootkit
117|qALJ/XeBayXYYD8G61i4ky3hSGi3V7hXM5t2hbuUB1Q=
-
rootkit_type
134|x3gl2P8VPodFARzWt34wXw==
-
task_client
122|w9zY9Ix+RKHeU8LUtz6yCQ==
-
task_watchdog
123|GPLXk3Icj9YvPw18tZcndg==
-
usb_spread
135|oSX2b+2GgWCgK1/X0KgEDg==
-
use_install_admin
114|bxaiV29TXI/xRB+qC9euBQ==
-
user_init
128|djhbqegfTsVGj3iT3La1YA==
-
winlogon_shell_enable
120|h1jL3/j1itY9fY1FUeq30w==
-
wmi_name
119|e5TrNp6iU/UvyWgj0ndr4w==
-
wmi_startup
118|guySF3+L6B9XWDv/Cvy/SA==
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\v09hlsq24iwrk0iw.exe"C:\Users\Admin\AppData\Local\Temp\v09hlsq24iwrk0iw.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|Ue9VZHdo2jymnEz8TbnwYLrTrhkxg2MR/S9U91jKNW4VLoZINfgvWaNMsedHMloNWindowsControl472|xIQVsboVCeJrSGg9T2EjsMCrJ01+AIl7yVD8BvNTzjQ=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/1272-498-0x00007FFA13790000-0x00007FFA137A6000-memory.dmp
memory/1272-500-0x000000000E1A0000-0x000000000E1AD000-memory.dmp
memory/1272-499-0x000000000A8F0000-0x000000000AA7E000-memory.dmp
memory/2188-304-0x0000025101AB0000-0x0000025101AD0000-memory.dmp
memory/2188-306-0x0000025104000000-0x0000025104100000-memory.dmp
memory/2188-341-0x0000025101E70000-0x0000025101E90000-memory.dmp
memory/2188-357-0x00000251142F0000-0x0000025114310000-memory.dmp
memory/2188-290-0x00000251001E0000-0x00000251002E0000-memory.dmp
memory/2404-227-0x000000000F870000-0x000000000F91E000-memory.dmp
memory/2404-226-0x000000000F1C0000-0x000000000F1CD000-memory.dmp
memory/3100-26-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-1-0x00007FF9F964F000-0x00007FF9F9650000-memory.dmp
memory/3100-24-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-25-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-0-0x0000029AD9370000-0x0000029AD93CC000-memory.dmp
memory/3100-22-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-29-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-27-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-244-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-21-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-6-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-23-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-2-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-3-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-5-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3100-4-0x00007FF9F94C0000-0x00007FF9F9E64000-memory.dmp
memory/3908-496-0x00007FFA13790000-0x00007FFA137A6000-memory.dmp
memory/3908-506-0x00007FFA13790000-0x00007FFA137A6000-memory.dmp
memory/4868-456-0x00007FFA13790000-0x00007FFA137A6000-memory.dmp
memory/5020-54-0x000001CA82E60000-0x000001CA82E80000-memory.dmp
memory/5020-30-0x000001CA801E0000-0x000001CA802E0000-memory.dmp
memory/5020-76-0x000001CA942E0000-0x000001CA94300000-memory.dmp
memory/5020-44-0x000001CA82EE0000-0x000001CA82FE0000-memory.dmp
memory/5020-43-0x000001CA82CD0000-0x000001CA82CF0000-memory.dmp
memory/5808-255-0x000001600B2B0000-0x000001600B2B1000-memory.dmp
memory/5808-253-0x000001600B2A0000-0x000001600B2A1000-memory.dmp
memory/5808-256-0x000001600B3E0000-0x000001600B3E1000-memory.dmp
memory/5808-257-0x000001600B3E0000-0x000001600B3E1000-memory.dmp
memory/5808-258-0x000001600B3F0000-0x000001600B3F1000-memory.dmp
memory/5808-259-0x000001600B3F0000-0x000001600B3F1000-memory.dmp
memory/5808-260-0x000001600B400000-0x000001600B401000-memory.dmp
memory/5808-261-0x000001600B400000-0x000001600B401000-memory.dmp
memory/5808-262-0x000001600B420000-0x000001600B421000-memory.dmp
memory/5808-263-0x000001600B420000-0x000001600B421000-memory.dmp
memory/5808-497-0x00007FFA13790000-0x00007FFA137A6000-memory.dmp
memory/5808-254-0x000001600B2B0000-0x000001600B2B1000-memory.dmp
memory/5808-501-0x00007FFA13790000-0x00007FFA137A6000-memory.dmp
memory/5808-252-0x000001600B2A0000-0x000001600B2A1000-memory.dmp