Analysis
- max time kernel
12s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/11/2026, 02:48
General
- Target DataBase.exe
- Size 916KB
- Sample261106-dat68shy7l
- SHA256 ce8d311bc103c8115b7ba8e6d58f4a3827fc53b7be41048beaa4bba67a8531d2
Malware Config
Extracted
-
gomorat
-
1.8
-
VoxelTools
-
2.26.81.75:51948
-
))u)!0*b)3)hb2$izp3@tfvq(+f
-
antivirtual
true
-
certificate
0m6dd1vduz
-
delay_unit
Seconds
-
delay_value
1
-
disk_spread
false
-
enable_delay
true
-
exclusion_wd
true
-
hidden_file
true
-
install
true
-
install_watchdog
true
-
key
gaasoh7yxn6r25weevuqjrgyk43
-
path_client
%ProgramFiles%\junkSearch.exe
-
path_watchdog
%Windows%\junkSearcher.exe
-
pump
false
-
rootkit
kom5ayw0y7atrq0eif
-
rootkit_type
junkkit
-
task_client
ShellHost
-
task_watchdog
CookieManager
-
usb_spread
true
-
use_install_admin
false
-
user_init
true
-
winlogon_shell_enable
true
-
wmi_name
WindowsDefender
-
wmi_startup
true
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DataBase.exe"C:\Users\Admin\AppData\Local\Temp\DataBase.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|pWXmr2UHY+7Q4KPncTxzM2CaZS0smROYTPZF9n2YT4my4RkbbFPNSWz3MkxqcZAyWindowsControl472|ncu4SWjBucH8d8qyKY1cIINokS2kPSunHiAtnRJgtik=C:\Program Files\junkSearch.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Program Files\junkSearch.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Windows\junkSearcher.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Program Files\junkSearch.exe"C:\Program Files\junkSearch.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
junkSearch.exe
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
5a2098e080cf7ac4.automaticDestinations-ms
junk.dll
memory/2524-481-0x00007FFEA4AA0000-0x00007FFEA4AB6000-memory.dmp
memory/2820-282-0x0000020C9EA70000-0x0000020C9EA71000-memory.dmp
memory/2820-528-0x00007FFEA4AA0000-0x00007FFEA4AB6000-memory.dmp
memory/2820-284-0x0000020C9EA80000-0x0000020C9EA81000-memory.dmp
memory/2820-286-0x0000020C9EA90000-0x0000020C9EA91000-memory.dmp
memory/2820-525-0x00007FFEA4AA0000-0x00007FFEA4AB6000-memory.dmp
memory/2820-285-0x0000020C9EA90000-0x0000020C9EA91000-memory.dmp
memory/2820-275-0x0000020C9EA40000-0x0000020C9EA41000-memory.dmp
memory/2820-283-0x0000020C9EA80000-0x0000020C9EA81000-memory.dmp
memory/2820-281-0x0000020C9EA70000-0x0000020C9EA71000-memory.dmp
memory/2820-280-0x0000020C9EA60000-0x0000020C9EA61000-memory.dmp
memory/2820-276-0x0000020C9EA40000-0x0000020C9EA41000-memory.dmp
memory/2820-277-0x0000020C9EA50000-0x0000020C9EA51000-memory.dmp
memory/2820-278-0x0000020C9EA50000-0x0000020C9EA51000-memory.dmp
memory/2820-279-0x0000020C9EA60000-0x0000020C9EA61000-memory.dmp
memory/2832-393-0x0000024914280000-0x00000249142A0000-memory.dmp
memory/2832-360-0x0000024913D40000-0x0000024913E40000-memory.dmp
memory/2832-343-0x00000249001E0000-0x00000249002E0000-memory.dmp
memory/2832-379-0x0000024903C20000-0x0000024903C40000-memory.dmp
memory/2832-358-0x0000024903920000-0x0000024903940000-memory.dmp
memory/3824-527-0x00000000134B0000-0x000000001366E000-memory.dmp
memory/3824-526-0x00007FFEA4AA0000-0x00007FFEA4AB6000-memory.dmp
memory/4660-532-0x00007FFEA4AA0000-0x00007FFEA4AB6000-memory.dmp
memory/4660-524-0x00007FFEA4AA0000-0x00007FFEA4AB6000-memory.dmp
memory/5580-269-0x0000000011B10000-0x0000000011CCE000-memory.dmp
memory/5704-95-0x000001B994270000-0x000001B994290000-memory.dmp
memory/5704-86-0x000001B982D10000-0x000001B982D30000-memory.dmp
memory/5704-82-0x000001B982DF0000-0x000001B982EF0000-memory.dmp
memory/5704-81-0x000001B9829D0000-0x000001B9829F0000-memory.dmp
memory/5704-57-0x000001B9801E0000-0x000001B9802E0000-memory.dmp
memory/5928-30-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-27-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-38-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-37-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-36-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-35-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-34-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-33-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-32-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-31-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-268-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-29-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-28-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-0-0x000002A217470000-0x000002A217554000-memory.dmp
memory/5928-26-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-11-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-10-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-9-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-8-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-7-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-6-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-5-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-4-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-3-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-2-0x00007FFE8A5C0000-0x00007FFE8AF64000-memory.dmp
memory/5928-1-0x00007FFE8A74F000-0x00007FFE8A750000-memory.dmp