Analysis
- max time kernel
12s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
08/11/2026, 17:22
General
- Target Xeno.exe
- Size 828KB
- Sample261108-vxsqcsd18q
- SHA256 9002a47791b632df3834e6267fb2c86738874c0cc0c8e95cd94aa5f390299ebc
Malware Config
Extracted
-
gomorat
-
1.8
-
t.me/junk_code
-
skynet1488.mywire.org:20594
-
av5s$7vt1af#w2^hq0+3*!trfh@u45$
-
antivirtual
false
-
certificate
rw65f2hajt
-
delay_unit
Hours
-
delay_value
420
-
disk_spread
true
-
enable_delay
false
-
exclusion_wd
true
-
hidden_file
false
-
install
true
-
install_watchdog
true
-
key
9r7kraku
-
path_client
%Templates%\MicrosoftSearchTemplates.exe
-
path_watchdog
%UserProfile%\MicrosoftOneDriveHosts.exe
-
pump
false
-
rootkit
s1exb7nhyrjt5h7d9jehsdtdt2at
-
rootkit_type
junkkit
-
task_client
ShellHost
-
task_watchdog
CookieManager
-
usb_spread
true
-
use_install_admin
true
-
user_init
true
-
winlogon_shell_enable
true
-
wmi_name
WindowsDefender
-
wmi_startup
true
Signatures
- Family: GomoRAT
GomoRAT is a Windows RAT written in C#.
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Delays execution with timeout.exe 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno.exe"C:\Users\Admin\AppData\Local\Temp\Xeno.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" 471|LqysIUNvzW3x35ofYWhI8UwfAeN6bn9kmlR/oM8011cq7aZfygWZ0UoMR905OrJPWindowsControl472|8CBbw1kzHSAgbt3jDZxgCYqS63lR2fYbDRJqHjcOJZo=C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MicrosoftSearchTemplates.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MicrosoftSearchTemplates.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "ShellHost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MicrosoftSearchTemplates.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\MicrosoftOneDriveHosts.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "CookieManager" /tr "C:\Users\Admin\MicrosoftOneDriveHosts.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MicrosoftSearchTemplates.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MicrosoftSearchTemplates.exe"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /Tn "ShellHost" & exit& exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /Tn "ShellHost"4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /Tn "CookieManager" & exit& exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /Tn "CookieManager"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9D7A.tmp.bat""3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\userinit.exeC:\Windows\System32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MicrosoftSearchTemplates.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MicrosoftSearchTemplates.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
start2.bin
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
tmp9D7A.tmp.bat
5a2098e080cf7ac4.automaticDestinations-ms
MicrosoftSearchTemplates.exe
junk.dll
memory/1392-484-0x00007FFDAE7B0000-0x00007FFDAE7C6000-memory.dmp
memory/1696-460-0x00007FFDAE7B0000-0x00007FFDAE7C6000-memory.dmp
memory/2328-224-0x000000000E880000-0x000000000F0FB000-memory.dmp
memory/2848-480-0x0000016AF4E80000-0x0000016AF4EF8000-memory.dmp
memory/3112-529-0x00007FFDAE7B0000-0x00007FFDAE7C6000-memory.dmp
memory/3452-13-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-9-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-17-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-15-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-12-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-142-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-5-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-11-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-10-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-4-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-8-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-223-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-7-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-6-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-3-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-2-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/3452-1-0x00007FFD973EF000-0x00007FFD973F0000-memory.dmp
memory/3452-0-0x0000024D84FE0000-0x0000024D850B6000-memory.dmp
memory/3712-239-0x0000023D7E7F0000-0x0000023D7E7F1000-memory.dmp
memory/3712-241-0x0000023D7E800000-0x0000023D7E801000-memory.dmp
memory/3712-236-0x0000023D7E7D0000-0x0000023D7E7D1000-memory.dmp
memory/3712-235-0x0000023D7E7D0000-0x0000023D7E7D1000-memory.dmp
memory/3712-234-0x0000023D7E7C0000-0x0000023D7E7C1000-memory.dmp
memory/3712-233-0x0000023D7E7C0000-0x0000023D7E7C1000-memory.dmp
memory/3712-232-0x0000023D7E7B0000-0x0000023D7E7B1000-memory.dmp
memory/3712-231-0x0000023D7E7B0000-0x0000023D7E7B1000-memory.dmp
memory/3712-238-0x0000023D7E7E0000-0x0000023D7E7E1000-memory.dmp
memory/3712-486-0x00007FFDAE7B0000-0x00007FFDAE7C6000-memory.dmp
memory/3712-483-0x00007FFDAE7B0000-0x00007FFDAE7C6000-memory.dmp
memory/3712-240-0x0000023D7E7F0000-0x0000023D7E7F1000-memory.dmp
memory/3712-237-0x0000023D7E7E0000-0x0000023D7E7E1000-memory.dmp
memory/3712-242-0x0000023D7E800000-0x0000023D7E801000-memory.dmp
memory/4336-83-0x000001DD941E0000-0x000001DD94200000-memory.dmp
memory/4336-50-0x000001DD81DD0000-0x000001DD81ED0000-memory.dmp
memory/4336-38-0x000001DD801E0000-0x000001DD802E0000-memory.dmp
memory/4336-37-0x000001DD801E0000-0x000001DD802E0000-memory.dmp
memory/4336-39-0x000001DD801E0000-0x000001DD802E0000-memory.dmp
memory/4336-49-0x000001DD81940000-0x000001DD81960000-memory.dmp
memory/4336-58-0x000001DD81AF0000-0x000001DD81B10000-memory.dmp
memory/4776-269-0x000001D4801E0000-0x000001D4802E0000-memory.dmp
memory/4776-302-0x000001D482C60000-0x000001D482C80000-memory.dmp
memory/4776-284-0x000001D482E20000-0x000001D482F20000-memory.dmp
memory/4776-271-0x000001D4801E0000-0x000001D4802E0000-memory.dmp
memory/4776-282-0x000001D482A00000-0x000001D482A20000-memory.dmp
memory/4776-316-0x000001D4841E0000-0x000001D484200000-memory.dmp
memory/4804-482-0x00007FFDAE7B0000-0x00007FFDAE7C6000-memory.dmp
memory/4804-489-0x00007FFDAE7B0000-0x00007FFDAE7C6000-memory.dmp
memory/5624-485-0x000001BDB7000000-0x000001BDB7691000-memory.dmp
memory/5624-537-0x000001BDB7000000-0x000001BDB7691000-memory.dmp
memory/6112-528-0x00007FFDAE7B0000-0x00007FFDAE7C6000-memory.dmp