Forensia CTI Core

About

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings. Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host. In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance. Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.

Platforms: IaaS, Linux, macOS, WindowsMITRE ATT&CK ↗

Used by actors

2 known groups

G1008 SideCopy G1017 Volt Typhoon

Software

24 malware/tools implement this

PlugXCrimsonQuasarRATRemcosSDBbotRagnar LockerGrimAgentDarkWatchmanSaint BotAmadeyDarkGateSocGholishGootloaderRaccoon StealerCuckoo StealerRedLine StealerInvisibleFerretXORIndex LoaderHexEval LoaderGlassWormPureCrypterSameCoinAshTagTsundere Botnet

Corpus indicators tagged with this technique

148 indicators in the corpus carry T1614.

Indicator	Type	Family	Sev	Src
4991873515d6dea70d7769cf67ccd8ea69184e5e454a6e6d1e093b6a3c48eb47	sha256	—	80	1
92710bdb44279dbe8ccff34ba698d1558fa6d271c99ed4960ccbfb6d518d9418	sha256	—	80	1
2267d05dbd5e30c6dfcdde25731280dd755e689faa684bd21cfbef5281fd3e86	sha256	—	80	1
3e17ce0b30b9fd6863b341ae58ee118dc13f2ee7f1c92ac4b81c04d54480d0e0	sha256	—	80	1
7a370a9262d37de6a24706f92ff0cdded7202281a6ff3bf313721756226ebff9	sha256	—	80	1
8bef879c6920cdce7c01b8dbb7da24dca23b8822a7aa00dfc72cb32f55879a24	sha256	—	80	1
19e0070e5009bd5b376b9be997361d0773dcb004200ee8fafe6c14b96cbd93e4	sha256	—	80	1
1d52ded1f3838a1eee849ae20b2fee6c84b183cc98abe7244365b9f34b925eea	sha256	—	80	1
2d8e5a2763f9a899fda44390d5b8495836c11fb266a61868d52d1f397c5243ee	sha256	—	80	1
307964ed02f34bff4e40c5402cc936be07fd9957ef400596a4b3e2cd98c50ec1	sha256	—	80	1
ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736	sha256	—	80	1
57edeb575862ce8d3bff2eb4d32d9e3fa1ffb7cb8f818e2e7fc6d25a506faea6	sha256	—	80	1
85816d89dac648645a9026973772815e956c267232b3d2577a06a43418f19ed3	sha256	—	80	1
88f9e169a85dcf6a1c03bf3ca1b1a262ed32baeca46cb87f0324adfdc098d4a2	sha256	—	80	1
66bf111030a2e22db575c0b7b7b677208745eef8b44265bb4259f41f126f1bf8	sha256	—	80	1
12b41c07299d2535f7cdc194d97496acd944a9eb5d94b8d24b19291ed9d0830c	sha256	—	80	1
7d8b6a64f7b65b281e7b5568929c6f96c62bbae9628162aabe7d8140a86d3de8	sha256	—	80	1
1c01ab1b59245f24ebdc5d9c414fcf4e2ce31f71f181522efc5a3d27476c8e21	sha256	—	80	1
2d5615acd1b0666995fd124fb72f2713c6609b5368350340288b52fecbdd016d	sha256	—	80	1
5a23ca644cb1f310be1abd5f6c6a3b3e15681ced99b0947a7f3465a79aae5089	sha256	—	80	1
a8acc24bb3e6a1a3b66a31ceaefda07d4a0e17415468683458b499f2ba240450	sha256	—	80	1
d55ce447e249ef9045750865fa196c8ca8434c8c484f861b7bdecbceeab7c16e	sha256	—	80	1
ad0f892b7b99b68491ade4949ef6b575e64d9df5f84a53019b5c1e4eeb4c46a9	sha256	—	80	1
1d699a46339626db299548e32ed3a77eec267840c3de39b49caf38b88aeb150d	sha256	—	80	1
4e035575be8fe350a9e36cf29dbbc8826af2f772672bd08c9e489a243cb90e31	sha256	—	80	1
5562246e38f8935ba8b07350e6aaa44bc22abf37b77f49836fde5999f4b61cf1	sha256	—	80	1
8419b1f0acca46d45f4c54c315c8cc4784946e07d547fe55187b928fa6c6b8f5	sha256	—	80	1
848036661c71b80ee41566918faa5eae3bf4f03ae807bb4af42cb483b6c141e2	sha256	—	80	1
512adab2c69feaf026adfb12cbd7d2eb4fee746120491e44f476eebddcbb19f2	sha256	—	80	1
a4b34b94a905fe330b0a3e4502aa45356e383a8f45ff1d008b785ea0ec14acaf	sha256	—	80	1

Showing the top 30 by severity of 148.