Windows Analysis Report
GateUtilityHelper.exe

Overview

General Information

Sample name: GateUtilityHelper.exe
Analysis ID: 1428920
MD5: ea802d05db84a72cd98fe9b3628832c8
SHA1: 7c3c11e9dea2fdc111180d107daff5f3d0b71374
SHA256: 42e59f21ff168b461817dedeec34c97c06c2f675ebb2be932f0948024c96c34c
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Reads the Security eventlog
Reads the System eventlog
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates or modifies windows services
May sleep (evasive loops) to hinder dynamic analysis
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)

Classification

Source: GateUtilityHelper.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: D:\Tycon\GateUtility\GateUtility\GateUtilityHelper\obj\Release\GateUtilityHelper.pdb source: GateUtilityHelper.exe

Spam, unwanted Advertisements and Ransom Demands
barindex
Reads the Security eventlog
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\GateUtilityHelper Jump to behavior
Reads the System eventlog
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\GateUtilityHelper Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System Jump to behavior
PE file does not import any functions
Source: GateUtilityHelper.exe Static PE information: No import functions for PE file found
Source: classification engine Classification label: mal48.evad.winEXE@4/0@0/0
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Mutant created: NULL
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6760:120:WilError_03
Source: GateUtilityHelper.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: GateUtilityHelper.exe Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\GateUtilityHelper.exe "C:\Users\user\Desktop\GateUtilityHelper.exe"
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\Desktop\GateUtilityHelper.exe "C:\Users\user\Desktop\GateUtilityHelper.exe"
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Section loaded: wintypes.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: GateUtilityHelper.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: GateUtilityHelper.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: GateUtilityHelper.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: GateUtilityHelper.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\Tycon\GateUtility\GateUtility\GateUtilityHelper\obj\Release\GateUtilityHelper.pdb source: GateUtilityHelper.exe
Binary contains a suspicious time stamp
Source: GateUtilityHelper.exe Static PE information: 0xE330603D [Fri Oct 13 17:19:57 2090 UTC]
Creates or modifies windows services
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Memory allocated: 16F4AF10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Memory allocated: 16F62F50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Memory allocated: 2007D6F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Memory allocated: 2007F190000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\GateUtilityHelper.exe TID: 7012 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe TID: 6300 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Queries volume information: C:\Users\user\Desktop\GateUtilityHelper.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\GateUtilityHelper.exe Queries volume information: C:\Users\user\Desktop\GateUtilityHelper.exe VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1428920 Sample: GateUtilityHelper.exe Startdate: 19/04/2024 Architecture: WINDOWS Score: 48 5 GateUtilityHelper.exe 2 1 2->5         started        8 GateUtilityHelper.exe 1 2->8         started        signatures3 14 Reads the Security eventlog 5->14 16 Reads the System eventlog 5->16 10 conhost.exe 5->10         started        12 conhost.exe 8->12         started        process4
⊘No contacted IP infos