Analysis
- max time kernel
12s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 16:53
General
- Target tnv5gej3jtpbhuvo.exe
- Size 833KB
- Sample261029-vd32zsds21
- SHA256 c38c27e9fa994d827073bb7ff2da4d2a351acb06720fad16eb4fa3b42cb1a410
Malware Config
Extracted
-
gomorat
-
1.8
-
t.me/junk_code
-
130.49.213.211:20780
-
@junk_code
-
antivirtual
false
-
certificate
phys7cja3oal21wcnt0b6dheu
-
delay_unit
Hours
-
delay_value
420
-
disk_spread
false
-
enable_delay
false
-
exclusion_wd
true
-
hidden_file
true
-
install
true
-
install_watchdog
true
-
key
54u0dbhuxb5ouwn2nf37djs
-
path_client
%ProgramFiles%\junkSearch.exe
-
path_watchdog
%Windows%\junkSearcher.exe
-
pump
false
-
rootkit
eh4rnqot97sepxohwi1quexq3
-
rootkit_type
junkkit
-
task_client
ShellHost
-
task_watchdog
CookieManager
-
usb_spread
true
-
use_install_admin
true
-
user_init
true
-
winlogon_shell_enable
true
-
wmi_name
WindowsDefender
-
wmi_startup
true
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tnv5gej3jtpbhuvo.exe"C:\Users\Admin\AppData\Local\Temp\tnv5gej3jtpbhuvo.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|S4NbXQlediCBHQr2NIvdTwIkAa0QY3t8Jifh2DfyqThJtQLtnj/wCGqRIydi2rDwWindowsControl472|kFgIzenMM4II+H81gs0fk0rl2VXG4Aw2aUDJG7XFdSg=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/484-344-0x00000163819E0000-0x0000016381A00000-memory.dmp
memory/484-345-0x0000016381DE0000-0x0000016381EE0000-memory.dmp
memory/484-360-0x00000163842A0000-0x00000163842C0000-memory.dmp
memory/484-314-0x00000163801E0000-0x00000163802E0000-memory.dmp
memory/484-346-0x0000016381C20000-0x0000016381C40000-memory.dmp
memory/556-70-0x000001DE818F0000-0x000001DE81910000-memory.dmp
memory/556-47-0x000001DE81CD0000-0x000001DE81DD0000-memory.dmp
memory/556-84-0x000001DE94570000-0x000001DE94590000-memory.dmp
memory/556-38-0x000001DE801E0000-0x000001DE802E0000-memory.dmp
memory/556-39-0x000001DE801E0000-0x000001DE802E0000-memory.dmp
memory/556-40-0x000001DE801E0000-0x000001DE802E0000-memory.dmp
memory/556-46-0x000001DE81B30000-0x000001DE81B50000-memory.dmp
memory/600-525-0x00007FFE03960000-0x00007FFE03976000-memory.dmp
memory/2232-526-0x0000026318000000-0x0000026318434000-memory.dmp
memory/2452-523-0x00007FFE03960000-0x00007FFE03976000-memory.dmp
memory/3476-230-0x0000000010450000-0x0000000010733000-memory.dmp
memory/3696-9-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-27-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-28-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-34-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-33-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-7-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-32-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-6-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-267-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-29-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-30-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-1-0x00007FFDEEDCF000-0x00007FFDEEDD0000-memory.dmp
memory/3696-0-0x000001F16C110000-0x000001F16C1E2000-memory.dmp
memory/3696-31-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-10-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-12-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-2-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-3-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-8-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-4-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-26-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/3696-5-0x00007FFDEEC40000-0x00007FFDEF5E4000-memory.dmp
memory/5024-285-0x00000287CF120000-0x00000287CF121000-memory.dmp
memory/5024-279-0x00000287CF0E0000-0x00000287CF0E1000-memory.dmp
memory/5024-280-0x00000287CF0F0000-0x00000287CF0F1000-memory.dmp
memory/5024-274-0x00000287CF0C0000-0x00000287CF0C1000-memory.dmp
memory/5024-275-0x00000287CF0C0000-0x00000287CF0C1000-memory.dmp
memory/5024-276-0x00000287CF0D0000-0x00000287CF0D1000-memory.dmp
memory/5024-277-0x00000287CF0D0000-0x00000287CF0D1000-memory.dmp
memory/5024-278-0x00000287CF0E0000-0x00000287CF0E1000-memory.dmp
memory/5024-284-0x00000287CF120000-0x00000287CF121000-memory.dmp
memory/5024-528-0x00007FFE03960000-0x00007FFE03976000-memory.dmp
memory/5024-283-0x00000287CF110000-0x00000287CF111000-memory.dmp
memory/5024-282-0x00000287CF110000-0x00000287CF111000-memory.dmp
memory/5024-524-0x00007FFE03960000-0x00007FFE03976000-memory.dmp
memory/5024-281-0x00000287CF0F0000-0x00000287CF0F1000-memory.dmp
memory/5336-485-0x00007FFE03960000-0x00007FFE03976000-memory.dmp