Overview
overview
10Static
static
10Bunifu.Licensing.dll
windows10-2004-x64
Bunifu.UI.....3.dll
windows10-2004-x64
1Bunifu.UI....on.dll
windows10-2004-x64
1Bunifu.UI....ox.dll
windows10-2004-x64
1Bunifu.UI....ss.dll
windows10-2004-x64
1Bunifu.UI....on.dll
windows10-2004-x64
1Bunifu.UI....ew.dll
windows10-2004-x64
1Bunifu.UI....er.dll
windows10-2004-x64
1Bunifu.UI....wn.dll
windows10-2004-x64
1Bunifu.UI....ck.dll
windows10-2004-x64
7Bunifu.UI....ge.dll
windows10-2004-x64
1Bunifu.UI....el.dll
windows10-2004-x64
1Bunifu.UI....ox.dll
windows10-2004-x64
1Bunifu.UI....on.dll
windows10-2004-x64
1Bunifu.UI....el.dll
windows10-2004-x64
1Bunifu.UI....es.dll
windows10-2004-x64
1Bunifu.UI....el.dll
windows10-2004-x64
1Bunifu.UI....ox.dll
windows10-2004-x64
1Bunifu.UI....ar.dll
windows10-2004-x64
1Bunifu.UI....on.dll
windows10-2004-x64
1Bunifu.UI....ng.dll
windows10-2004-x64
1Bunifu.UI....ar.dll
windows10-2004-x64
1Bunifu.UI....or.dll
windows10-2004-x64
1Bunifu.UI....el.dll
windows10-2004-x64
1Bunifu.UI....es.dll
windows10-2004-x64
1Bunifu.UI....er.dll
windows10-2004-x64
1Bunifu.UI....ar.dll
windows10-2004-x64
1Bunifu.UI....ox.dll
windows10-2004-x64
1Bunifu.UI....ch.dll
windows10-2004-x64
1Bunifu.UI....ip.dll
windows10-2004-x64
1Bunifu.UI....on.dll
windows10-2004-x64
1Bunifu.UI....ol.dll
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 16:22
Behavioral task
behavioral1
Sample
Bunifu.Licensing.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Bunifu.UI.WinForms.1.5.3.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Bunifu.UI.WinForms.BunifuButton.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Bunifu.UI.WinForms.BunifuCheckBox.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Bunifu.UI.WinForms.BunifuCircleProgress.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Bunifu.UI.WinForms.BunifuColorTransition.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Bunifu.UI.WinForms.BunifuDataGridView.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Bunifu.UI.WinForms.BunifuDatePicker.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Bunifu.UI.WinForms.BunifuDropdown.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Bunifu.UI.WinForms.BunifuFormDock.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Bunifu.UI.WinForms.BunifuGauge.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Bunifu.UI.WinForms.BunifuGradientPanel.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Bunifu.UI.WinForms.BunifuGroupBox.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Bunifu.UI.WinForms.BunifuImageButton.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Bunifu.UI.WinForms.BunifuLabel.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Bunifu.UI.WinForms.BunifuPages.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Bunifu.UI.WinForms.BunifuPanel.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Bunifu.UI.WinForms.BunifuPictureBox.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Bunifu.UI.WinForms.BunifuProgressBar.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Bunifu.UI.WinForms.BunifuRadioButton.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Bunifu.UI.WinForms.BunifuRating.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Bunifu.UI.WinForms.BunifuScrollBar.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Bunifu.UI.WinForms.BunifuSeparator.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Bunifu.UI.WinForms.BunifuShadowPanel.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Bunifu.UI.WinForms.BunifuShapes.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Bunifu.UI.WinForms.BunifuSlider.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Bunifu.UI.WinForms.BunifuSnackbar.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Bunifu.UI.WinForms.BunifuTextBox.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Bunifu.UI.WinForms.BunifuToggleSwitch.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Bunifu.UI.WinForms.BunifuToolTip.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Bunifu.UI.WinForms.BunifuTransition.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Bunifu.UI.WinForms.BunifuUserControl.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
Bunifu.UI.WinForms.BunifuFormDock.dll
-
Size
102KB
-
MD5
fff8d46f94011c5bfa4bc1d1fbde3eaa
-
SHA1
c5e978eb89e9646423c3b2a1d7d2651cdbee90f0
-
SHA256
f8052b4641fea785ef643bc06d0e5383555c0845bbe695099bc41ab09a180ef6
-
SHA512
61af0253c05bd33d43d34799eb74d97ae9e3e700281273895026d690f39e3de97034ee51511284a4b6a4150d31977f7ac6fbf4047aa19825564a15eae8be079a
-
SSDEEP
3072:wVypYUOJdOb8UD8m1PxGFXflE2BHjvZKDq6CN:wVypYUSXdbBjvZKDq1N
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 8 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral10/memory/368-2-0x000001A24B6B0000-0x000001A24B6D0000-memory.dmp agile_net behavioral10/memory/368-3-0x000001A24B6D0000-0x000001A24B6F0000-memory.dmp agile_net behavioral10/memory/368-4-0x000001A265770000-0x000001A2657DE000-memory.dmp agile_net behavioral10/memory/368-7-0x000001A24CFC0000-0x000001A24CFD0000-memory.dmp agile_net behavioral10/memory/368-6-0x000001A2659E0000-0x000001A265A3A000-memory.dmp agile_net behavioral10/memory/368-5-0x000001A24B6F0000-0x000001A24B6FE000-memory.dmp agile_net behavioral10/memory/368-8-0x000001A2656D0000-0x000001A2656EE000-memory.dmp agile_net behavioral10/memory/368-10-0x000001A265B90000-0x000001A265CDA000-memory.dmp agile_net -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe 368 Umbral.builder.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 368 Umbral.builder.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Bunifu.UI.WinForms.BunifuFormDock.dll,#11⤵PID:5004
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\Umbral.builder.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.builder.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368