Skip to content

T1614.001 System Language Discovery

Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.1

There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.2

For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.345

On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.

Item Value
ID T1614.001
Sub-techniques T1614.001
Tactics TA0007
Platforms Linux, Windows, macOS
Permissions required User
Version 1.0
Created 18 August 2021
Last Modified 15 October 2021

Procedure Examples

ID Name Description
S0640 Avaddon Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.19
S0534 Bazar Bazar can perform a check to ensure that the operating system’s keyboard and language settings are not set to Russian.11
S0611 Clop Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the GetTextCharset function.14
S0625 Cuba Cuba can check if Russian language is installed on the infected machine by using the function GetKeyboardLayoutList.9
S0616 DEATHRANSOM Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.13
S0547 DropBook DropBook has checked for the presence of Arabic language in the infected machine’s settings.7
S0696 Flagpro Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.10
S0632 GrimAgent GrimAgent has used Accept-Language to identify hosts in the United Kingdom, United States, France, and Spain.20
G0004 Ke3chang Ke3chang has used implants to collect the system language ID of a compromised machine.6
S0652 MarkiRAT MarkiRAT can use the GetKeyboardLayout API to check if a compromised host’s keyboard is set to Persian.8
S0449 Maze Maze has checked the language of the machine with function GetUserDefaultUILanguage and terminated execution if the language matches with an entry in the predefined list.21
S0083 Misdat Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call GetKeyboardType.16
S0691 Neoichor Neoichor can identify the system language on a compromised host.6
C0022 Operation Dream Job During Operation Dream Job, Lazarus Group deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.22
S0496 REvil REvil can check the system language using GetUserDefaultUILanguage and GetSystemDefaultUILanguage. If the language is found in the list, the process terminates.18
S0446 Ryuk Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage. If the machine has the value 0x419 (Russian), 0x422 (Ukrainian), or 0x423 (Belarusian), it stops execution.2
S0085 S-Type S-Type has attempted to determine if a compromised system was using a Japanese keyboard via the GetKeyboardType API call.16
S0546 SharpStage SharpStage has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed.7
S0543 Spark Spark has checked the results of the GetKeyboardLayoutList and the language name returned by GetLocaleInfoA to make sure they contain the word “Arabic” before executing.17
S0242 SynAck SynAck lists all the keyboard layouts installed on the victim’s system using GetKeyboardLayoutList API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.5
S0658 XCSSET XCSSET uses AppleScript to check the host’s language and location with the command user locale of (get system info).15
S0330 Zeus Panda Zeus Panda queries the system’s keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.12

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0009 Process OS API Execution
DS0024 Windows Registry Windows Registry Key Access

References

  1. Pierre-Marc Bureau. (2009, January 15). Malware Trying to Avoid Some Countries. Retrieved August 18, 2021. ↩

  2. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020. ↩↩

  3. Cybereason Nocturnus. (2021, April 1). Cybereason vs. Darkside Ransomware. Retrieved August 18, 2021. ↩

  4. Fedor Sinitsyn. (2021, May 25). Evolution of JSWorm Ransomware. Retrieved August 18, 2021. ↩

  5. Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018. ↩↩

  6. MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022. ↩↩

  7. Ilascu, I. (2020, December 14). Hacking group’s new malware abuses Google and Facebook services. Retrieved December 28, 2020. ↩↩

  8. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021. ↩

  9. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021. ↩

  10. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022. ↩

  11. Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020. ↩

  12. Brumaghin, E., et al. (2017, November 02). Poisoning the Well: Banking Trojan Targets Google Search Results. Retrieved November 5, 2018. ↩

  13. McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021. ↩

  14. Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021. ↩

  15. Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021. ↩

  16. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021. ↩↩

  17. Falcone, R., et al. (2020, March 3). Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations. Retrieved December 14, 2020. ↩

  18. Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020. ↩

  19. Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021. ↩

  20. Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved July 16, 2021. ↩

  21. Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020. ↩

  22. ClearSky Research Team. (2020, August 13). Operation ‘Dream Job’ Widespread North Korean Espionage Campaign. Retrieved December 20, 2021. ↩