Analysis
- user interaction
yes - max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
05/11/2026, 23:09
General
- Target lbcv1c4y2vw7buoa.exe
- Size 993KB
- Sample261105-2446ashh52
- SHA256 80bc64b90440ecdcc721af4b26c5f11c01aa32f89052b9775cd03f6ce1853af3
Malware Config
Extracted
-
gomorat
-
1.8
-
t.me/junk_code
-
frpcports.duckdns.org:38063
-
@junk_code
-
antivirtual
false
-
certificate
2z5zqc
-
delay_unit
Seconds
-
delay_value
5
-
disk_spread
false
-
enable_delay
false
-
exclusion_wd
true
-
hidden_file
true
-
install
true
-
install_watchdog
false
-
key
yxoj9bzm3q537zn4ioe09icafy
-
path_client
%ProgramFiles%\junkSearch.exe
-
path_watchdog
#2qn*g#ky$xat@r1!^5t
-
pump
true
-
rootkit
bste7kxnewp7gpgtz52od
-
rootkit_type
junkkit
-
task_client
ShellHost
-
task_watchdog
+mfiw(#svhxahcn#@2wje
-
usb_spread
true
-
use_install_admin
true
-
user_init
true
-
winlogon_shell_enable
true
-
wmi_name
WindowsDefender
-
wmi_startup
false
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\lbcv1c4y2vw7buoa.exe"C:\Users\Admin\AppData\Local\Temp\lbcv1c4y2vw7buoa.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|AXYxphcjXvNDmwP3r3h1pZTEZw9TvqQlha4cWlND+XpxnGjXvuEllTuLV/X66zaxWindowsControl472|ZdhWm7m1HTOygTax5K9Hmp6//rcwoKXQaDZhAssVyDg=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/696-523-0x00007FFC0B3B0000-0x00007FFC0B3C6000-memory.dmp
memory/696-521-0x00007FFC0B3B0000-0x00007FFC0B3C6000-memory.dmp
memory/948-475-0x00007FFC0B3B0000-0x00007FFC0B3C6000-memory.dmp
memory/1100-274-0x00000188E34C0000-0x00000188E34C1000-memory.dmp
memory/1100-280-0x00000188E34F0000-0x00000188E34F1000-memory.dmp
memory/1100-273-0x00000188E34A0000-0x00000188E34A1000-memory.dmp
memory/1100-276-0x00000188E34D0000-0x00000188E34D1000-memory.dmp
memory/1100-277-0x00000188E34D0000-0x00000188E34D1000-memory.dmp
memory/1100-520-0x00007FFC0B3B0000-0x00007FFC0B3C6000-memory.dmp
memory/1100-279-0x00000188E34E0000-0x00000188E34E1000-memory.dmp
memory/1100-272-0x00000188E34A0000-0x00000188E34A1000-memory.dmp
memory/1100-281-0x00000188E34F0000-0x00000188E34F1000-memory.dmp
memory/1100-282-0x00000188E3500000-0x00000188E3501000-memory.dmp
memory/1100-283-0x00000188E3500000-0x00000188E3501000-memory.dmp
memory/1100-278-0x00000188E34E0000-0x00000188E34E1000-memory.dmp
memory/1100-275-0x00000188E34C0000-0x00000188E34C1000-memory.dmp
memory/1100-526-0x00007FFC0B3B0000-0x00007FFC0B3C6000-memory.dmp
memory/1464-39-0x0000023F00080000-0x0000023F00180000-memory.dmp
memory/1464-38-0x0000023F00080000-0x0000023F00180000-memory.dmp
memory/1464-65-0x0000023F03B60000-0x0000023F03B80000-memory.dmp
memory/1464-51-0x0000023F13BE0000-0x0000023F13CE0000-memory.dmp
memory/1464-50-0x0000023F037C0000-0x0000023F037E0000-memory.dmp
memory/1464-40-0x0000023F00080000-0x0000023F00180000-memory.dmp
memory/1464-84-0x0000023F13FE0000-0x0000023F14000000-memory.dmp
memory/1864-12-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-9-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-35-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-266-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-34-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-33-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-31-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-32-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-30-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-29-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-28-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-13-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-0-0x00007FFBF41BF000-0x00007FFBF41C0000-memory.dmp
memory/1864-11-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-10-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-36-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-8-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-7-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-1-0x000001FE65EE0000-0x000001FE65FDA000-memory.dmp
memory/1864-2-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-3-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-4-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-5-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/1864-6-0x00007FFBF4030000-0x00007FFBF49D4000-memory.dmp
memory/5124-348-0x0000018C83A30000-0x0000018C83A50000-memory.dmp
memory/5124-350-0x0000018C83E90000-0x0000018C83F90000-memory.dmp
memory/5124-379-0x0000018C84310000-0x0000018C84330000-memory.dmp
memory/5124-365-0x0000018C83D70000-0x0000018C83D90000-memory.dmp
memory/5124-331-0x0000018C801E0000-0x0000018C802E0000-memory.dmp
memory/5656-522-0x00007FFC0B3B0000-0x00007FFC0B3C6000-memory.dmp