gomorat | 65934558b1c59cd884a8aedf3eeee7d832db75032912928ae3b3e87af64df415

Analysis

max time kernel
12s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3qxbrpnyep3tjm91.exe
Size 875KB
Sample261027-mdm2rstsas
SHA256 65934558b1c59cd884a8aedf3eeee7d832db75032912928ae3b3e87af64df415
MD5 b9aa113da1f4cd71d046e3a25df9400f
SHA1 0b28eac60297ccce1e448ea9c267656f35e8119d
SHA512 43715942827d01621076e06e34c3b9a530e116fd6767f4e2f700c9b6ced809d919f6a7a58cefc540e86503a39d1ced6925df0abd4f2ff13c1df134648aac2c38
SSDEEP 12288:UX+K9DUdYQIrLnpSC7TEEAOZ3+DPtljUWqCcEzv0mnrnzt2O3N2Z:i9J9npteOb4nVc
TLSH
T19C15F86A7B828F09E065687DCCCD3322D7A51FF32723634B3B086714178A1DA9D1A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code costura discovery execution gomorat packer persistence rat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:20810

Mutex

@junk_code

Attributes

antivirtual
false
certificate
n941fi4c3sb7sm9e143eo1wycgmxmy
delay_unit
Hours
delay_value
420
disk_spread
false
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
yu4cyd07hf
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
yt4rbq35haink2uj
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
10	api.ipify.org
18	api.ipify.org
21	api.ipify.org

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/memory/4912-523-0x0000017EDA1B0000-0x0000017EDA228000-memory.dmp	costura

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3564	cmd.exe
5640	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3qxbrpnyep3tjm91.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3qxbrpnyep3tjm91.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2808	schtasks.exe
6060	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3160	3qxbrpnyep3tjm91.exe

C:\Users\Admin\AppData\Local\Temp\3qxbrpnyep3tjm91.exe
"C:\Users\Admin\AppData\Local\Temp\3qxbrpnyep3tjm91.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3160
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" 471|ZEQxIZGk9Ai+b2COTl7A5b0umA5nVRzkrCWFplvXfhw/w5PjYj9SBuzARfbTAkfcWindowsControl472|M3hmI39Bfv+JtI9hDPzPPVTStWOUHDfr5uKY48wRMWc=C:\Program Files\junkSearch.exe" enable=yes & exit
  2⤵
  PID:4804
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3564
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2808
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5640
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- C:\Program Files\junkSearch.exe
  "C:\Program Files\junkSearch.exe"
  2⤵
  PID:4912
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:4540

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5356
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3396

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:432

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2092

C:\Windows\System32\userinit.exe
C:\Windows\System32\userinit.exe
1⤵
PID:5568
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3820

C:\Program Files\junkSearch.exe
"C:\Program Files\junkSearch.exe"
1⤵
PID:5676

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3480

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

junkSearch.exe

Path C:\Program Files\junkSearch.exe
Size 875KB
SHA256 65934558b1c59cd884a8aedf3eeee7d832db75032912928ae3b3e87af64df415
MD5 b9aa113da1f4cd71d046e3a25df9400f
SHA1 0b28eac60297ccce1e448ea9c267656f35e8119d
SHA512 43715942827d01621076e06e34c3b9a530e116fd6767f4e2f700c9b6ced809d919f6a7a58cefc540e86503a39d1ced6925df0abd4f2ff13c1df134648aac2c38
SSDEEP 12288:UX+K9DUdYQIrLnpSC7TEEAOZ3+DPtljUWqCcEzv0mnrnzt2O3N2Z:i9J9npteOb4nVc
TLSH
T19C15F86A7B828F09E065687DCCCD3322D7A51FF32723634B3B086714178A1DA9D1A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start2.bin

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin
Size 3KB
SHA256 aefe325d4a993fcf8e55274494550af51989f0f2a72aace15ea2b8db41fd6173
MD5 7d4cb957bfdbef58d4af85cdad612e30
SHA1 743812d7f3f4505d7db8a6a72f30042b47d835f8
SHA512 46c20d216122cbda5834896e77ae3e5448ed3ace13f50871518ef8b5234965e93f5f7d1871898d91da60fd5b54a990f26d2dd7f9e673bfa970ca38d3de7c8b02
TLSH
T1EB716CC2AD7C72F25C047ED875A43C0A92B1F6C4755AE011E0F725166A4A3E4ACDC631
MD5 SHA1 SHA512 TLSH

Submit Download