Analysis
- max time kernel
11s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 10:42
General
- Target oax1fzmej3vuqjux.exe
- Size 386KB
- Sample261027-mr7nbsct2s
- SHA256 f0ebc2250322fff2d26931279b2d9df6ec49fe19e997ad1385ff1509347a6e97
Malware Config
Extracted
-
gomorat
-
110|dKq2mIS/txtRc4btECIUsw==
-
109|roY+ehGCF6jKdDUOHxEMWA==
-
108|enx/y7sHnqiBZ8Gqq24tRKAuB68iBqKD1ZGdIDVSZqY=
-
111|yu8aMxUmCq6CarmFyRUh3A==
-
antivirtual
127|v2ADIPJcSXlTcTch7XplHw==
-
certificate
126|Awome/7qcrriZKOIU7b7vIJkPHkwMFqEkmwBD5zYdKE=
-
delay_unit
133|g4YV3nHGl50mGGQuoOF4RA==
-
delay_value
132|RmS2IfQd/OUgHECpZ/JXjQ==
-
disk_spread
136|wOjrxYXEoo0raIk4M9pnng==
-
enable_delay
131|vlaW1HPwZ1kqbeQ/JUYu5w==
-
exclusion_wd
115|mwuektkhjl56kKIi+1qBJg==
-
hidden_file
116|a7HLlOWfF086q9LllULYyw==
-
install
112|0oeVmA+MXE+A/XcdqFwkKg==
-
install_watchdog
113|6UztBTIayfbFwgxZ6XfyiA==
-
key
129|1Ip63/7f6K6o8OH3V6Pxmw==
-
pastebin_url
130|4a7FKC89goB3u7C5Epv5PA==
-
path_client
124|f+1MDwwX9T2mjExU13jPmAXBHjLlj3W6u9zAhtH1ssU=
-
path_watchdog
125|wDG/ijcGnGM+EglIUzgioAknqlq679kE0tpnm+aJITk=
-
pump
121|LHLVs1nAjtsBw/8NbJngVA==
-
rootkit
117|o5j0eJ+LoYml7tHlxzG9TEMnb+UCw9qI9rgNQp/o/bI=
-
rootkit_type
134|ESKuKRdjvDKPEIy0axtQpw==
-
task_client
122|1rBX09M58HUPcnOojVJ0OQ==
-
task_watchdog
123|a6Wcg11b7ylj9iEm+dktMg==
-
usb_spread
135|/siIQjJP1o3poMlAjX7GDw==
-
use_install_admin
114|4tryXg07geEamAZcdEA9bg==
-
user_init
128|Ar7ZWgAdI8qmRt0KgnQC4g==
-
winlogon_shell_enable
120|g2QW1ubV3ZwUqHCA/iF3pA==
-
wmi_name
119|7E0QiHQs+aU/cVl1hxhOJw==
-
wmi_startup
118|P3EFPuuCYgpbFBGkbAToGA==
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\oax1fzmej3vuqjux.exe"C:\Users\Admin\AppData\Local\Temp\oax1fzmej3vuqjux.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|s/e/PFRj13b+8kGVNiT1MJjIIw1+0Z2rGzz6McPepnfikTme3Bbgk89XeGl4oJXKWindowsControl472|949EIQM47bDJLpqgAmi1yL8wH2IM7cpPWbUR66VMbqg=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/1988-325-0x0000022C001E0000-0x0000022C002E0000-memory.dmp
memory/1988-340-0x0000022C02910000-0x0000022C02930000-memory.dmp
memory/1988-358-0x0000022C02B70000-0x0000022C02B90000-memory.dmp
memory/1988-341-0x0000022C02D70000-0x0000022C02E70000-memory.dmp
memory/1988-326-0x0000022C001E0000-0x0000022C002E0000-memory.dmp
memory/1988-372-0x0000022C14680000-0x0000022C146A0000-memory.dmp
memory/3360-259-0x0000000009660000-0x00000000096A2000-memory.dmp
memory/3756-266-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/3756-268-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3756-528-0x00007FF9C4F20000-0x00007FF9C4F36000-memory.dmp
memory/3756-529-0x0000000006410000-0x0000000006487000-memory.dmp
memory/3756-269-0x00000000033E0000-0x00000000033E1000-memory.dmp
memory/3756-270-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/3756-271-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/3756-272-0x0000000003400000-0x0000000003401000-memory.dmp
memory/3756-274-0x0000000003410000-0x0000000003411000-memory.dmp
memory/3756-275-0x0000000003410000-0x0000000003411000-memory.dmp
memory/3756-273-0x0000000003400000-0x0000000003401000-memory.dmp
memory/3756-267-0x00000000033D0000-0x00000000033D1000-memory.dmp
memory/3756-276-0x0000000003420000-0x0000000003421000-memory.dmp
memory/3756-277-0x0000000003420000-0x0000000003421000-memory.dmp
memory/4028-531-0x00007FF9C4F20000-0x00007FF9C4F36000-memory.dmp
memory/4028-526-0x00007FF9C4F20000-0x00007FF9C4F36000-memory.dmp
memory/4580-530-0x00007FF9C4F20000-0x00007FF9C4F36000-memory.dmp
memory/4580-527-0x00007FF9C4F20000-0x00007FF9C4F36000-memory.dmp
memory/4908-471-0x00007FF9C4F20000-0x00007FF9C4F36000-memory.dmp
memory/5800-0-0x00007FF9AD9CF000-0x00007FF9AD9D0000-memory.dmp
memory/5800-4-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-25-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-10-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-9-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-8-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-7-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-6-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-5-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-258-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-3-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-2-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-27-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/5800-1-0x000001D36F3D0000-0x000001D36F434000-memory.dmp
memory/5800-152-0x00007FF9AD840000-0x00007FF9AE1E4000-memory.dmp
memory/6020-28-0x000001E1801E0000-0x000001E1802E0000-memory.dmp
memory/6020-57-0x000001E182920000-0x000001E182940000-memory.dmp
memory/6020-91-0x000001E1942C0000-0x000001E1942E0000-memory.dmp
memory/6020-67-0x000001E182BC0000-0x000001E182BE0000-memory.dmp
memory/6020-58-0x000001E182EC0000-0x000001E182FC0000-memory.dmp