#h�^S����T��=���"'\�'��ʡ��!�XyJI�ڱ��d���/�iQ�LʔF�4�$����]��X�Z�F��%8R.RO!�ܾGڽ����8[��I6O�>kL����~�9�+��H��G����x��X&�a�àD�4��L��Ҁr�^X^b �>Sck��Sy'�����z�C|�-�?�Pl�0#����{a��B��@�ęf4��b���5UH�c~gV��n�m��7��y^�&2eLR�v��s�V@�ȃˀe�N�"�r���е_��5܆_pφd��Xʽ�h�S���0���ø��l`��D��'��L�^�I�& �a�'w|����\~�f'%�P�y/���'K_V��n��א��GC�K�!V{=���Z⊣|?��)��W� ��NF�p��i�]3��嘮���w��nNH>v+�:�4���nb���md�HW|��7,`RP +S ���|ߧ�gr��#Z������v!�4�0K�edg��4�Ц�����z@D��F��Eքb���翉�<��φ�AH��kJ���y$|B ��bm- �(F�F#%���a� NW��;�-���^�.z/S9���%zh���*ԭF�'� �`�3���\���9��.0�ܯ�^pPٯ��|*2.;X�vʃ�2���2�(����/o��i�z��J �;��c�o6�wl�B.vt<�n>�kG�x-�lջ�N��e�xu���X��E�ВU�!LtP��[����)N�,r҈Ԡ���Qg!����s+�$,��1�z���BX��ą�O� ���n�����Fy/��J�/ ��Na�.�ޮ� �.���̧qƪ�c�v���>vӈ�O���6+3���p$R~ZV��?�kĸ{>��$���qm#�;�e\w�W"�r�W���uR8hn'2 �oY�'�%�;�,Y����������#xe������|UQN.�UϤ�ft:���Hh}�� J�"!!ø�y�L6����{�>sP2��K�=��Y��j�<�ЄA��Bs|���$)~�dw9=tu퇏��r��4���͘�R�Qs�v-��h5 z:��:X�X�9���E5%M�`�}b���o��5�~=�?>����O�Y`�I'k���Y`F�c���n�V�ȅ�G�l���M��CN�KnK �F!�{g�m#n2b�M�0���Ҏ�yv� [�܆(��2���<�J; >�t�D����x��V����&��ZfP�$�s�&t�H����S�w���([UގF�}���n6�#N *o��1�#�ͳ�q�(2��sp`=U)�����/�]��R�[x"����Vz죌ӽ0��m���ˠx�3l�� U��1��I�`h��uc��ߤ�2O!k�@C�-c��T���>�c�>�N?�n�Sg�[������>�w�����BĚyfH�Se(�t"D����3a� �h#hr�G40�ʰ V���c�,7���r �A��:�/�>- �~�j��y{<I��D�t����*���79{P�h=i����m�u��+0�鱗q�����r�hf�`���(�[=��_zQA��=��*��jo�~��@��2c��2�>��M/7V�mD͈������g߳�4!�D0�0ۍ�c5πo��v���������I�ݜ�������.��$i����D�W��a`� pr��LJ�k��ڧ(R��&ν�$\�v�%!�u;W��3>K��i�-������6��[=���t��u�LJ�8��p� �N��������eiX���^��p�HOD'i�EO{o�<y �%����� GڰA���=Ӫ�����C(�c��sJ����u�_.�D��nd����|��7R����:3y�L�P]����>x1��t�yRt4��M��`_:lWd%x���s?-Ėh0$���\����${�s�x� c��ð��K��c�H(�aE���h.��;�O-��g�I�sx��lKJ,.�� ���ɒ�Xڦv$`Ppb���M�փ���L9ʗD���Z`-�%���g#�ݯ��!�o�Ň}e���I�h��ٓ�b��A�K��R�0��4�� bHE�m�� j�����UB�I�s�_����:��&�r��P�e1 �ƭb��[3RHܭ��[�>�B���ͻ�o���^�0�|thtn�{����Q>ʹ��zr�.��/��s�5G���܃�G�S^l�S�5S#�eg�oO�wO�@�ᰛ��=�~���UW�[W�%���Jf������ډ����&AGѳ�ޘ��U:��r���P�rP�/�!�}����(p��Weo,�a�W7��>�k��d�q���?Jd�$�7�*(�@����߆�A�OIH�qt�)�x������G �&��Lҋ���NT��"tI�7������a皷����) +�-��� �"6'!�w�; �O�+8��1rLE�>�aC_��rA:�맋PԨ55D+�����zs�����@l��^�%+ӡ.~�k�� �����"���@�q��>$7,���b�������ƖZ�暭;��ç����V���XoN��>���x���ip��� �?�J�702cf)�d> ��5�Zk-%dL�;���+��{���&K��.� E3� Vv�P"}p��oH����N����bT�n,��;U%�͑&�>�PG�,'�p��A{���8Cʠ�nnGlx��"+H2=���!:.�O�6c6�W=>1���U�D���|#b-��s�M�;�VL|��]����y$�E.8Ǫ�O��#l'��&�=H���[>z �+�Q�Q4���ڧ��0��_q�/�}�[���t�甧���_��r^�BGX���V�%��̋w���OOl���$ޑ�6.^X!X�o�[ r���4���lb�W`���goY�����Q���DϊzݫV�c��6�F(�F���~�zm�D��'��%�Or�?#�8��G'�k����l�8K�As�f���պ�����1�-�W�j��-��ͨm���:ڶъ<�6��Ú�+ʛ�~&�6�x�����Z��s���}�B�t��4ݜw
Static task
static1
Behavioral task
behavioral1
Sample
onetapus.dll
Resource
win10v2004-20220812-en
General
-
Target
onetapus.dll
-
Size
6.3MB
-
MD5
51365663945f811cf16fef88f829381d
-
SHA1
1994b752fb097a9abcbb0b3fe7282974f69f6bdb
-
SHA256
69cd7464a2a5c991a65f9265f18564c88231d45b724dab48499c0621f58d0bae
-
SHA512
c79490020f4b8569f41fec0104a3f8ef541698d7f9c65756d55092090fc202553a6387442c579fb8819706bdfa6d344ad93f3fac9178c921dc3acfef3050d895
-
SSDEEP
98304:qdYWLme8OmOXGjjjVFXTqOrpv+z8W8J3L5oHIW2kUT5bZhAMoZOaZ2v2aUPjmAZ:qdZmbd3j/G2bnlyIW21ZhAM2nwu7V
Malware Config
Signatures
Files
-
onetapus.dll.dll windows x86
419fe70bf128b055120a1c9ea649eec3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Beep
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-heap-l1-1-0
malloc
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fuckvmp Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fuckvmp Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 5.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ