20b645182b67300df69644e6fc830aad2ebf2870e1edd70cbf296c13c9d3e6b5

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 11:25

Target

2024-10-04_ecf78ff371967a8057c7c2294109a7bb_icedid.exe
Size

10KB
MD5

ecf78ff371967a8057c7c2294109a7bb
SHA1

456db2b2dc338903b6c027ad6668eae4b991cda9
SHA256

20b645182b67300df69644e6fc830aad2ebf2870e1edd70cbf296c13c9d3e6b5
SHA512

93156f14991230813b9584c91bc7369c1eb3533d41a741fc9f67a09e00a5fe7a3f0669158adff2acc50263c6ecb284e582767e0d9bc59b6aaf2e14f8031b692b
SSDEEP

192:5piF7hWH0iI8jKWE2uNB+PEwtDtfhNI4wkcpfSbxNPDt:KNh8q8joRmPEihnEsbxNP

Score

3^/10

discovery

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

2024-10-04_ecf78ff371967a8057c7c2294109a7bb_icedid.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-04_ecf78ff371967a8057c7c2294109a7bb_icedid.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-04_ecf78ff371967a8057c7c2294109a7bb_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-10-04_ecf78ff371967a8057c7c2294109a7bb_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-04_ecf78ff371967a8057c7c2294109a7bb_icedid.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1456

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact