gomorat | 15cebfc70e53a55d3ddf64830058ad2e3002b73fb3011afba1beecb50eeb6652

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kmulb6unwjtvlco0.exe
Size 848KB
Sample261027-pbghbatxbx
SHA256 15cebfc70e53a55d3ddf64830058ad2e3002b73fb3011afba1beecb50eeb6652
MD5 b7f3dc67128bb5955a35c18fd4091b3f
SHA1 e4b86e280870afd43b8c150547c8b5e8998cd533
SHA512 31a685f6636aafa567cf0e41394dda651d34ddf9b22151c6fedba0bca21ecec6cb33d2b4e9f201599b2fa7523e42d43a6e5d98afb49f2a171fbdbef772ddc92b
SSDEEP 12288:6T6ek6sE1Sf4Gz0vMuaPlmJSXxiaMCS3IAKbGTEp4h3TnT:W6ekPz1z0vh2lmJQygv4f
TLSH
T15205D66A7B828F09E065693DCCCD3322D7A51FF32333634B3B086714168A5DA9D1A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

t.me/junk_code discovery execution gomorat persistence rat

Malware Config

Extracted

Family

gomorat

Version

Botnet

t.me/junk_code

130.49.213.211:20780

Mutex

@junk_code

Attributes

antivirtual
false
certificate
dtb9ar
delay_unit
Hours
delay_value
420
disk_spread
true
enable_delay
false
exclusion_wd
true
hidden_file
true
install
true
install_watchdog
true
key
26nimk03vl5ntcm6jkfdzglz
path_client
%ProgramFiles%\junkSearch.exe
path_watchdog
%Windows%\junkSearcher.exe
pump
false
rootkit
e6nt7r9brnxrp3ghdf00xi3p9m77e0c
rootkit_type
junkkit
task_client
ShellHost
task_watchdog
CookieManager
usb_spread
true
use_install_admin
true
user_init
true
winlogon_shell_enable
true
wmi_name
WindowsDefender
wmi_startup
true

Signatures

Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
rat gomorat

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
19	api.ipify.org
21	api.ipify.org
1	api.ipify.org
11	api.ipify.org

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6012	cmd.exe
4088	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	kmulb6unwjtvlco0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	kmulb6unwjtvlco0.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4928	schtasks.exe
5820	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	kmulb6unwjtvlco0.exe

C:\Users\Admin\AppData\Local\Temp\kmulb6unwjtvlco0.exe
"C:\Users\Admin\AppData\Local\Temp\kmulb6unwjtvlco0.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2468
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:4756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" 471|Ts839r3UTQptke2hRM340w9s6pmfCuo+Us+EGQ+eRboHD5BtKgQ3VIghnxmS2GAxWindowsControl472|fkPjkv+cEFNTd7Pt91rOgzCj9hWNDTk1mA4XYIyu1So=C:\Program Files\junkSearch.exe" enable=yes & exit
  2⤵
  PID:1972
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6012
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4928
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5820
- C:\Program Files\junkSearch.exe
  "C:\Program Files\junkSearch.exe"
  2⤵
  PID:3016
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2772

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:5252
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:2972

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2656

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5680

C:\Windows\System32\userinit.exe
C:\Windows\System32\userinit.exe
1⤵
PID:2536
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:4048

C:\Program Files\junkSearch.exe
"C:\Program Files\junkSearch.exe"
1⤵
PID:4720

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3012

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

junkSearch.exe

Path C:\Program Files\junkSearch.exe
Size 848KB
SHA256 15cebfc70e53a55d3ddf64830058ad2e3002b73fb3011afba1beecb50eeb6652
MD5 b7f3dc67128bb5955a35c18fd4091b3f
SHA1 e4b86e280870afd43b8c150547c8b5e8998cd533
SHA512 31a685f6636aafa567cf0e41394dda651d34ddf9b22151c6fedba0bca21ecec6cb33d2b4e9f201599b2fa7523e42d43a6e5d98afb49f2a171fbdbef772ddc92b
SSDEEP 12288:6T6ek6sE1Sf4Gz0vMuaPlmJSXxiaMCS3IAKbGTEp4h3TnT:W6ekPz1z0vh2lmJQygv4f
TLSH
T15205D66A7B828F09E065693DCCCD3322D7A51FF32333634B3B086714168A5DA9D1A7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start2.bin

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start2.bin
Size 3KB
SHA256 588270b4f8779b7de3ab771f5b2d6d2ec4dfd67e7f6df525f05df8ff0b481557
MD5 8c7b6f09600a3d0dd360397f591f440a
SHA1 cb223bf683417b9ae2dc277c23272fc4d4e9fe1e
SHA512 1169944dd412dfd3a799bf673b93338c5f36ae214bf1cb72766949fa1ca8c5410993c59cbb1449fd00d5ddb2f5f3df2144b121367ae74cef4c0e23a0828cb297
TLSH
T119716D0DE891B2F9C61C5ADFAFF2E91AA8C7E71DA86B807351360040A91868A9150AC8
MD5 SHA1 SHA512 TLSH

Submit Download