� �;��WQ-�$�[r��g���{=��T(?X֗�� �G��"�^����T��T�(��]<�X㼷__S��5e�Z�,�Pb�h��8E����߾�^0�����?NE)A)�?�.h�v�|5���ʚ��,t�w��Oo��d&���]�.��h.���S�>D���W@��{{������9�sC#���]Y�N���W�':k/۸b��q�?y��y/\m2vG;3�'7/gY����h ^LJ��E�6�@'���#�2{Q�����HH�e��f��t$N��=���������7�Jt<�r���F��X�����v��}P�)��*}�����&���"���RUf8��`�|���K���0� ��S��A��:����W�@�x&S��9��y��}�b=.���`�(U�$�t��B2�ԟ%a�ME�`��W$%�?~ľ�����2���:;:�ʬ�g��>�[�M�@�ߝȚs�і�](R�?%Ha���AUR� ���vV��4��QJ"*&d�N�{w y�A�}���D+���_�j�9p���Xr�҇��Aq�o�3h�v���3ʾ��l�FR6�=Mm���.�J�����4 �8�3�����V�>t�A ��h;�{������I�������I�ꘫ�t����̄rk�ς�a�����$�p�swL� 2me�cc��[� i�k������%��Σ�VK������!��&\^�<uK�ܖwgy���VD��V�j]3��Y��f����a�U���ܷFp���\[��ީۤ��v���`zG���<!%%ܪ� ��2�������VE��zt�kȶX�3���c}QgX�}�K�a��j���3? ƒ2��sn�j���L���0�fnWa@7Ń������ #�w�� ,v;����dC��A�:G͔?�{����o�lIÌ�aWyBj��"\�:�]�'�w��/ӹg��r��,�3Aॣ[�ؖ(h�"J� �W�He��2R��6!����!�!�zH��\M<:��3��l��G,K�I�H�� z�R�¾Q�����`|���3�e��yIx2tT�����|��4���3���'���"�:�"\y����)�I�]�6���T��h���=���5wl�G �r�cR��&�u;1�x�4|_����3�bH���סv;����R�����9�1��X"B��6�+ kC+Y��O,��$�����5�)\���k���c��}T۽���;�t=�O�i��>���g`��<��}�>l�g�;�J���2���!���o�K#��<x�@ yȷ;�vӝ���s@��|���!�(xk�/ A���sQ�vqN�33��=ӫ0�}� R7W%���x���hZ�Tj�� ���ζ��Q��x>����hz('���.�"���)�{˗rt�?*Y(<<���4���{~�������KP]�g��#�AA���s�#����T���y��$ᅗ�,.$���2����ZY��&(�,�^D�b�^��h���i:�1 /ɥ�c�|�A2R����o��J>�ɢȄ�i�pq��O�[g�Mҩ/�r�.Ҁ0`���|�M�~WKL��o\ ��ZKg|�������E9Ư���Qjd����|]��-�0l��ҧF%f�X����Pֵ��>�7����O�j8s�0�;�_������rmnA���W����+ƠGL�U�$ϸ=�kKP�������Y�JPe�u�+䂵�]C��!��-�>����5}#���x+w](^�R}z o����_���Y�[ew����Ҏᑉ�o1�[i���=��U#�a%ߥ��)^�:˳���"�䠰�$�$#��l`*%��V�����J}z3�����L,�K(���qޅ^�v�0���d��S�|oD�d#�ܵȍa�����٦�x_�M�e��*�p9�'�G�����;�*R�m���A��C�_R!���D�7����SS�u��~���d�[� 9im})�Z!�FD{���+QX��0�#pf����|S�.��@��P,����RS���W}�P��"=� �b�[� 覭OD�����=(e�g}�^���'�Z����ڹHx�rנ��9h������;�/1����+n��yM��C]���a�� 5��7&�����,��O����!E����X�_��-�]����ɢs��iE*����DnO���`+���W�p.ي�x�r�WF�F��_rq),����K���K. ε��*�߾tB �F�<%>S�;u�,���˭>�_to6B6�0Sw�e<RN��W��c5n9���OJ!* ��_�t����&%Es�P������"�<4�n�iv̱��"��!�O��ժ�j�d����b-"O���ĺ�������Vȿ浄�D{�A���RO��UL)��;��X=>�d�Έ���Ll`�� 7 �i눯D���/b�K.��T��{\�C�l�����K�f��<�����߈I!��e����k� �#s��sw����,�a��F>�+*��̡���.���T0ui�s{d���x<��=z4Y�u3�м�~r���K�pn���G��pasAu�r_ �rtk��K�7 ���qY�:�}�\�M�"��w���߇�c8F��h$�n]���P�fB�=|�����aPN^W��i� k@d������W}��G�[�"-O&ހ�D{�����KX��|�00������H#\?� s���EF�u���ʔ��4���n �{�r���@�������f���iԞḽ>Ycԯ.i�XR��=���7K���%���]>L���a���ܲ�����>� ���<����]t;8<89"�o�� X���k���=�h�qڵ4��G�D�M��|p�r�-,��]aS/=Wϝ�k8�e%^�� i���2���x�]�����N�J�(l&{羀��">���ڊn?����<.�_0u>�D�T~:8�þ�Z�c¢x��+��X������,���k�X1�.�P̃@�LC�0`�C�/�
Static task
static1
Behavioral task
behavioral1
Sample
Omega.exe
Resource
win10v2004-20230703-en
General
-
Target
Omega.exe
-
Size
7.7MB
-
MD5
fabb93dc236654fbe8ed0b44262b4408
-
SHA1
b416220b0411d19eb47593caf77d1e277296cd09
-
SHA256
a5b397ac6a8f0319303213b9be2d4e7a8a92d73d32216139b19bf174f343aece
-
SHA512
8e2bea57d0e55a893a7115c56e1b5ac5070e17a2dc69a0b568b34c3b71c75e0ee2a75e6749339c9502c1f037447f943001da48a9fb585dbeac0062c60e52cc25
-
SSDEEP
196608:9bTkvIOfeKg0Ab2nSfzKMINHSn9Xn0aKzysermO:5xKgCSfXINy9Xn0jter
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Omega.exe
Files
-
Omega.exe.exe windows x64
cb07353bf6ddaf876020637fcf2d7ecf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
AcquireSRWLockExclusive
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
d3d11
D3D11CreateDeviceAndSwapChain
user32
MessageBoxA
CharUpperBuffW
gdi32
CreateRoundRectRgn
shell32
ShellExecuteA
ntdll
RtlDosPathNameToRelativeNtPathName_U_WithStatus
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-environment-l1-1-0
_wgetenv
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-math-l1-1-0
cos
api-ms-win-crt-locale-l1-1-0
_lock_locales
rpcrt4
UuidCreate
psapi
GetModuleInformation
shlwapi
SHDeleteKeyW
userenv
UnloadUserProfile
advapi32
ConvertSidToStringSidA
bcrypt
BCryptGenRandom
wldap32
ord216
ws2_32
htonl
Exports
Exports
Sections
.text Size: - Virtual size: 919KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.=PV Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Er2 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.b % Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ