Analysis
- max time kernel
16s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 12:12
General
- Target фывфыафып.exe
- Size 919KB
- Sample261027-pc7e5ady4m
- SHA256 0f67aff68fee969e9d2b764608e5f3081261e5a4b7d7ca065dd878b2ca41f043
Malware Config
Extracted
-
gomorat
-
1.8
-
t.me/junk_code
-
130.49.213.211:20810
-
@junk_code
-
antivirtual
false
-
certificate
zpszu3ax2
-
delay_unit
Hours
-
delay_value
420
-
disk_spread
false
-
enable_delay
false
-
exclusion_wd
true
-
hidden_file
true
-
install
true
-
install_watchdog
true
-
key
p7l4afbouhjoqpxqvj71m47vvfn6h
-
path_client
%ProgramFiles%\junkSearch.exe
-
path_watchdog
%Windows%\junkSearcher.exe
-
pump
false
-
rootkit
5b5hkonjxcxh0bz
-
rootkit_type
junkkit
-
task_client
ShellHost
-
task_watchdog
CookieManager
-
usb_spread
true
-
use_install_admin
true
-
user_init
true
-
winlogon_shell_enable
true
-
wmi_name
WindowsDefender
-
wmi_startup
true
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\фывфыафып.exe"C:\Users\Admin\AppData\Local\Temp\фывфыафып.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|/XpJxZhExff+q4MAfYSt9ZklDHI5/nNNTXM/zGMNwGP3wtvxDTRobjRBS1fN29qaWindowsControl472|sCUVJcv3ydqAvkW0k+Ao8z2KPKo+DJJ8+cpRn+j1G0Q=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/3004-492-0x00007FFD347F0000-0x00007FFD34806000-memory.dmp
memory/3584-292-0x0000024E05D20000-0x0000024E05D21000-memory.dmp
memory/3584-296-0x0000024E05D40000-0x0000024E05D41000-memory.dmp
memory/3584-290-0x0000024E05D10000-0x0000024E05D11000-memory.dmp
memory/3584-293-0x0000024E05D30000-0x0000024E05D31000-memory.dmp
memory/3584-294-0x0000024E05D30000-0x0000024E05D31000-memory.dmp
memory/3584-295-0x0000024E05D40000-0x0000024E05D41000-memory.dmp
memory/3584-289-0x0000024E05D10000-0x0000024E05D11000-memory.dmp
memory/3584-291-0x0000024E05D20000-0x0000024E05D21000-memory.dmp
memory/3584-297-0x0000024E05D50000-0x0000024E05D51000-memory.dmp
memory/3584-298-0x0000024E05D50000-0x0000024E05D51000-memory.dmp
memory/3584-299-0x0000024E05D60000-0x0000024E05D61000-memory.dmp
memory/3584-300-0x0000024E05D60000-0x0000024E05D61000-memory.dmp
memory/3584-534-0x00007FFD347F0000-0x00007FFD34806000-memory.dmp
memory/3584-536-0x00007FFD347F0000-0x00007FFD34806000-memory.dmp
memory/4008-13-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-10-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-36-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-0-0x00007FFD1F6CF000-0x00007FFD1F6D0000-memory.dmp
memory/4008-2-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-3-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-4-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-35-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-283-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-34-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-33-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-32-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-31-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-30-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-15-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-1-0x0000020231540000-0x000002023162A000-memory.dmp
memory/4008-14-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-11-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-12-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-5-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-9-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-8-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-7-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4008-6-0x00007FFD1F540000-0x00007FFD1FEE4000-memory.dmp
memory/4024-348-0x00000213001E0000-0x00000213002E0000-memory.dmp
memory/4024-381-0x0000021302B80000-0x0000021302BA0000-memory.dmp
memory/4024-357-0x0000021302A20000-0x0000021302A40000-memory.dmp
memory/4024-360-0x0000021302E00000-0x0000021302F00000-memory.dmp
memory/4024-396-0x0000021B1D7E0000-0x0000021B1D800000-memory.dmp
memory/4148-535-0x00007FFD347F0000-0x00007FFD34806000-memory.dmp
memory/4184-68-0x0000024981BD0000-0x0000024981BF0000-memory.dmp
memory/4184-69-0x0000024981DD0000-0x0000024981ED0000-memory.dmp
memory/4184-88-0x0000024981CD0000-0x0000024981CF0000-memory.dmp
memory/4184-38-0x00000249801E0000-0x00000249802E0000-memory.dmp
memory/4184-103-0x00000249946D0000-0x00000249946F0000-memory.dmp
memory/5948-533-0x00007FFD347F0000-0x00007FFD34806000-memory.dmp
memory/5948-539-0x00007FFD347F0000-0x00007FFD34806000-memory.dmp