Analysis
- max time kernel
11s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 11:21
General
- Target c3u50gjgbupetspf.exe
- Size 427KB
- Sample261027-nfzzsatthv
- SHA256 9f87724b5d8215a93f59f3b436173b09d310d2206a8321ddcf42750954fdece2
Malware Config
Extracted
-
gomorat
-
110|OfsYz5Wl4sLaVKwwnfdnlA==
-
109|Ads/Wd87d1qwB0BOWY64ug==
-
108|LcAtx9dWJ8/dwxp40hrTZzq4Je9+cWT5dxyDVQqwCyo=
-
111|whks9fzN44vKV+MsUkyaYw==
-
antivirtual
127|abOcrRUfgImPosJQ5AKeUg==
-
certificate
126|+PzS/F6MEA06EWAWz8zAq9T+SO1xAiPpZNCuhfxuk/o=
-
delay_unit
133|XqaJ/S/hRG3wsN0Ssf7Icw==
-
delay_value
132|eDs8Xt3QeMdh9cG3NdSsBQ==
-
disk_spread
136|YeFSjS/QfV3/ZmW9DTXh5w==
-
enable_delay
131|b3ejhLRiaZ1CcTc/bgl4nw==
-
exclusion_wd
115|2Ri6rNPLBWontnnRZJZysg==
-
hidden_file
116|6as22iyczPo6xeaoZLUdEA==
-
install
112|02EIsfsJSaOlXoycssCpsQ==
-
install_watchdog
113|ATR4bKh9MkmYFmLqRCHDuQ==
-
key
129|MOlLEHnhInyNq/rO33GOpRw/tFEeeTRKqcydhc1LaNM=
-
pastebin_url
130|as/SXrr2fMi+fsJFrI2+ow==
-
path_client
124|EJVRNDehda96Puw/MhMyW5gWuj9sm4NzKjrgthGeqiU=
-
path_watchdog
125|XGjk9yzqvfcSpRgRxLg7h8nUerIxDOPqkcs7ZNaGGQQ=
-
pump
121|G2AEjMhIDomK3C+u1mJY3Q==
-
rootkit
117|544RLJgpgSfB9YQQ4Z4yDb1OXyqRr2ah55CF0wma0tM=
-
rootkit_type
134|pKgRtFIaIfT+Rj7fT+ecUg==
-
task_client
122|BBysZor5AXZocAzWEzRBcg==
-
task_watchdog
123|UyuI5X86Qmr/SLezHhDvdQ==
-
usb_spread
135|wKvwl123QWVGiojlWDIwoA==
-
use_install_admin
114|YiMrFSsB2+kI8dScC1NiKg==
-
user_init
128|WUoLwW8zIB+yeLKgmInSig==
-
winlogon_shell_enable
120|6EIvXwVGGQShu6CyLeZw4g==
-
wmi_name
119|6l6gYReJeIhfMSABWdihtg==
-
wmi_startup
118|MESB4rvyihujfE3W9EiD2w==
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3u50gjgbupetspf.exe"C:\Users\Admin\AppData\Local\Temp\c3u50gjgbupetspf.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|FUNQidaNELRp9aHgETfLWsLAMfKgq7uto7APtNoP90oR8ubUhltWOzWkPNQoARaMWindowsControl472|/VBpynvNsb0aTlThUyORrIQrNdyaEjyVTWQVN8X2kJM=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/3088-63-0x0000020983930000-0x0000020983950000-memory.dmp
memory/3088-49-0x00000209801E0000-0x00000209802E0000-memory.dmp
memory/3088-51-0x00000209801E0000-0x00000209802E0000-memory.dmp
memory/3088-81-0x0000020983CF0000-0x0000020983D10000-memory.dmp
memory/3088-64-0x0000020993E00000-0x0000020993F00000-memory.dmp
memory/3088-95-0x0000020994170000-0x0000020994190000-memory.dmp
memory/3728-28-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-5-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-7-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-6-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-10-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-27-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-26-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-9-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-11-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-8-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-4-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-250-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-1-0x00007FFC0AD5F000-0x00007FFC0AD60000-memory.dmp
memory/3728-3-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-2-0x00007FFC0ABD0000-0x00007FFC0B574000-memory.dmp
memory/3728-0-0x0000025B87700000-0x0000025B8776C000-memory.dmp
memory/4132-529-0x00007FFC1FF30000-0x00007FFC1FF46000-memory.dmp
memory/4876-310-0x000002109C020000-0x000002109C120000-memory.dmp
memory/4876-309-0x0000021089BC0000-0x0000021089BE0000-memory.dmp
memory/4876-295-0x00000210884E0000-0x00000210885E0000-memory.dmp
memory/4876-328-0x0000021089FA0000-0x0000021089FC0000-memory.dmp
memory/4876-342-0x000002109C3A0000-0x000002109C3C0000-memory.dmp
memory/4876-294-0x00000210884E0000-0x00000210885E0000-memory.dmp
memory/4876-296-0x00000210884E0000-0x00000210885E0000-memory.dmp
memory/5228-496-0x00007FFC1FF30000-0x00007FFC1FF46000-memory.dmp
memory/5376-535-0x00007FFC1FF30000-0x00007FFC1FF46000-memory.dmp
memory/5376-527-0x00007FFC1FF30000-0x00007FFC1FF46000-memory.dmp
memory/5648-255-0x00000242FADE0000-0x00000242FADE1000-memory.dmp
memory/5648-257-0x00000242FADF0000-0x00000242FADF1000-memory.dmp
memory/5648-262-0x00000242FAE10000-0x00000242FAE11000-memory.dmp
memory/5648-261-0x00000242FAE10000-0x00000242FAE11000-memory.dmp
memory/5648-260-0x00000242FAE00000-0x00000242FAE01000-memory.dmp
memory/5648-256-0x00000242FADE0000-0x00000242FADE1000-memory.dmp
memory/5648-264-0x00000242FAE20000-0x00000242FAE21000-memory.dmp
memory/5648-263-0x00000242FAE20000-0x00000242FAE21000-memory.dmp
memory/5648-265-0x00000242FAE30000-0x00000242FAE31000-memory.dmp
memory/5648-528-0x00007FFC1FF30000-0x00007FFC1FF46000-memory.dmp
memory/5648-258-0x00000242FADF0000-0x00000242FADF1000-memory.dmp
memory/5648-266-0x00000242FAE30000-0x00000242FAE31000-memory.dmp
memory/5648-532-0x00007FFC1FF30000-0x00007FFC1FF46000-memory.dmp
memory/5648-259-0x00000242FAE00000-0x00000242FAE01000-memory.dmp