Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 11:19
General
- Target 19dwah3pf0um0mqx.exe
- Size 425KB
- Sample261027-ne62pscv6w
- SHA256 874d6005a31dc18c999ff58e218e9f9251e0a4a60c5a90bc641cd675a5b95224
Malware Config
Extracted
-
gomorat
-
110|9s9PGos7u7NmSBWlQLlIVQ==
-
109|hynyGlKcBnGw/mYU8ERgjQ==
-
108|xHJLAKou22Iur/OAOj4CCEjd0NpZveMt8aaRWKX3ngA=
-
111|caNoTXEMSAPHC2nUr1zi4g==
-
antivirtual
127|VktbDazd9Q2Qj0l/jsHM3Q==
-
certificate
126|FQJqpko4U33V2kkqzYXlRpc3NuQuThb6oZ52eJgZnyE=
-
delay_unit
133|3xx28R1lemw+N6KZGvazjg==
-
delay_value
132|0DRphi0CHkvJgyHDRTdltw==
-
disk_spread
136|PfwQOCyR2qzFtwbUQ8bqRA==
-
enable_delay
131|A3I3u4p9xx9ZiBUwlNP0rw==
-
exclusion_wd
115|rIr2DN+5ifgapHvNeEyrYg==
-
hidden_file
116|m50KjvF/qO9Z8TdxKTh1Vg==
-
install
112|Vy50tnZvzg6Fy1qMeCv2yw==
-
install_watchdog
113|n82uPZwzoj9S1O7dMkfO1Q==
-
key
129|wYF7r+8fS4dUkqN4vzBXXw==
-
pastebin_url
130|vZiYQK9CC2ppB1OwJwwYhQ==
-
path_client
124|YgKNr/hKxX31r5ex71lKwF87xmsX13XHJvPGdVHORd0=
-
path_watchdog
125|+e5h03p6cBsDItoRN75M1LTFFFt3jqpd9DijbArl1Ik=
-
pump
121|BREt/mWEiolbT/gijleXiA==
-
rootkit
117|4pr9EiKSHN3Jm/I4u/pJO7Kwc1jpasg2a/M2pyKwZyA=
-
rootkit_type
134|daAUA21N3HTNj7dJ83GA2Q==
-
task_client
122|kGPdYV/WseNXFD4l2uPOkw==
-
task_watchdog
123|vX0F13boZ6szyLXk0+6xMA==
-
usb_spread
135|2zkmBhWma5ac8DgaNLAt6Q==
-
use_install_admin
114|YF+mVRHBBFOHb57vAE16sQ==
-
user_init
128|3u4rhazxfNk+AssPqbh+sg==
-
winlogon_shell_enable
120|/3ozY5Z1LaTm1mhFzYMyHA==
-
wmi_name
119|NiKVAwYd08dklEiZXJtTEw==
-
wmi_startup
118|0M41lBLFO3dajhTKE99AaQ==
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19dwah3pf0um0mqx.exe"C:\Users\Admin\AppData\Local\Temp\19dwah3pf0um0mqx.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|cmy9+reByXvG0AUp7wg+KeEoxJiBAEKZ5SSNROetM+/aV2BFd9msc+2FIM9c9TODWindowsControl472|xyXqEWgig3TvsTVPWZYU9F4BRLS/NxVHA61vj78w6Ks=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/248-457-0x00007FFAB9860000-0x00007FFAB9876000-memory.dmp
memory/1428-53-0x0000022803A30000-0x0000022803A50000-memory.dmp
memory/1428-56-0x0000022813EE0000-0x0000022813FE0000-memory.dmp
memory/1428-90-0x00000228142C0000-0x00000228142E0000-memory.dmp
memory/1428-31-0x00000228001E0000-0x00000228002E0000-memory.dmp
memory/1428-32-0x00000228001E0000-0x00000228002E0000-memory.dmp
memory/1428-33-0x00000228001E0000-0x00000228002E0000-memory.dmp
memory/1428-65-0x0000022803DA0000-0x0000022803DC0000-memory.dmp
memory/1708-334-0x0000021C81D20000-0x0000021C81D40000-memory.dmp
memory/1708-348-0x0000021C842A0000-0x0000021C842C0000-memory.dmp
memory/1708-302-0x0000021C801E0000-0x0000021C802E0000-memory.dmp
memory/1708-311-0x0000021C81EE0000-0x0000021C81FE0000-memory.dmp
memory/1708-309-0x0000021C819C0000-0x0000021C819E0000-memory.dmp
memory/1944-498-0x00007FFAB9860000-0x00007FFAB9876000-memory.dmp
memory/2660-264-0x000001F9F7CA0000-0x000001F9F7CA1000-memory.dmp
memory/2660-263-0x000001F9F7C90000-0x000001F9F7C91000-memory.dmp
memory/2660-502-0x00007FFAB9860000-0x00007FFAB9876000-memory.dmp
memory/2660-494-0x00007FFAB9860000-0x00007FFAB9876000-memory.dmp
memory/2660-265-0x000001F9F7CA0000-0x000001F9F7CA1000-memory.dmp
memory/2660-266-0x000001F9F7CB0000-0x000001F9F7CB1000-memory.dmp
memory/2660-273-0x000001F9F7CE0000-0x000001F9F7CE1000-memory.dmp
memory/2660-262-0x000001F9F7C90000-0x000001F9F7C91000-memory.dmp
memory/2660-272-0x000001F9F7CE0000-0x000001F9F7CE1000-memory.dmp
memory/2660-271-0x000001F9F7CD0000-0x000001F9F7CD1000-memory.dmp
memory/2660-270-0x000001F9F7CD0000-0x000001F9F7CD1000-memory.dmp
memory/2660-269-0x000001F9F7CC0000-0x000001F9F7CC1000-memory.dmp
memory/2660-268-0x000001F9F7CC0000-0x000001F9F7CC1000-memory.dmp
memory/2660-267-0x000001F9F7CB0000-0x000001F9F7CB1000-memory.dmp
memory/2968-7-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-5-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-1-0x00007FFAA265F000-0x00007FFAA2660000-memory.dmp
memory/2968-6-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-11-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-10-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-9-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-8-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-12-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-256-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-29-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-4-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-3-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-2-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-13-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-28-0x00007FFAA24D0000-0x00007FFAA2E74000-memory.dmp
memory/2968-0-0x0000026290F70000-0x0000026290FDE000-memory.dmp
memory/3924-499-0x00007FFAB9860000-0x00007FFAB9876000-memory.dmp
memory/3924-495-0x00007FFAB9860000-0x00007FFAB9876000-memory.dmp