70347ad989b5b39ea974b824900609b73cc30f14b0058de7d4da56fb8eb8207d

Analysis

max time kernel
146s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 11:22

Target

2024-10-04_330423de98e6bf1f381f7f3c9274bb38_icedid.exe
Size

10KB
MD5

330423de98e6bf1f381f7f3c9274bb38
SHA1

9975311df8d6d27a3a6e32c81e3615c51cab1ae0
SHA256

70347ad989b5b39ea974b824900609b73cc30f14b0058de7d4da56fb8eb8207d
SHA512

4a3575e5f9cda77faa65537efb882e5e67965343107e642cd4804c880ee73833be6761495a61ad72007178a36444fc758d018d4fbdffb07cfed57d0961a7c5e5
SSDEEP

192:5piF7hWH0iI8jKWE2uNB+PEwtDtfdWR5ygK/pfSbxNPDt:KNh8q8joRmPEibWfdK/sbxNP

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

2024-10-04_330423de98e6bf1f381f7f3c9274bb38_icedid.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-04_330423de98e6bf1f381f7f3c9274bb38_icedid.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-04_330423de98e6bf1f381f7f3c9274bb38_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-04_330423de98e6bf1f381f7f3c9274bb38_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-04_330423de98e6bf1f381f7f3c9274bb38_icedid.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:876

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact