Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Indrik Spider (threat actor)
Risk
84
Critical
40 techniques 52 tools/malware 1 vulnerabilities 65 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1590
Gather Victim Network Information reconnaissance
›
2 Weaponization
4
T1583
Acquire Infrastructure resource development
T1584.004
Server resource development
T1585.002
Email Accounts resource development
T1587.001
Malware resource development
›
3 Delivery
No data
›
4 Exploitation
8
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.007
JavaScript execution
T1106
Native API execution
T1204.002
Malicious File execution
CVE CVE-2025-22457
›
5 Installation
9
T1003.001
LSASS Memory credential access
T1552.001
Credentials In Files credential access
T1555.005
Password Managers credential access
T1558.003
Kerberoasting credential access
T1007
System Service Discovery discovery
T1012
Query Registry discovery
T1018
Remote System Discovery discovery
T1136
Create Account persistence
T1136.001
Local Account persistence
›
6 Command & Control
4
T1074.001
Local Data Staging collection
T1105
Ingress Tool Transfer command and control
T1021.001
Remote Desktop Protocol lateral movement
T1021.004
SSH lateral movement
›
7 Actions on Objectives
15
T1112
Modify Registry defense impairment
T1484.001
Group Policy Modification defense impairment
T1685
Disable or Modify Tools defense impairment
T1685.005
Clear Windows Event Logs defense impairment
T1567.002
Exfiltration to Cloud Storage exfiltration
T1486
Data Encrypted for Impact impact
T1489
Service Stop impact
T1036.005
Match Legitimate Resource Name or Location stealth
T1078
Valid Accounts stealth
T1078.002
Domain Accounts stealth
T1218.010
Regsvr32 stealth
T1574.001
DLL stealth
T1064?
T1064?
T1086?
T1086?
T1511?
T1511?
Stage risk: Critical High Medium None

Tools & Malware (52)

APT38 Akira Avaddon Babuk Backdoors BitPaymer Black Basta BlackByte BlackCat Carbon Clop Cobalt Cobalt Strike Cobalt Strike Cobalt Strike - S0154 Cobalt Strike Custom RATs Custom malware DLL injection payloads Dark DarkSide DoppelPaymer Dridex Emotet Global Hades Hades Ransomware Hades ransomware Kimsuky Latrodectus LockBit Malware Medusa MuddyWater Nexus PLAY Payload Phishing campaigns Phishing kits PowerShell REvil Royal Ryuk STOP Spear-phishing TrickBot Trojan Turla WastedLocker Wicked Winnti phishing

Indicators of Compromise (65)

Domain
WScript.Shell TEMP.Hermit TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex Mallory.ai +15 more
Email Address
rocke@live.cn
Filename
entry.client-xi9AqQZ0.js explorer.exe regsvr32.exe kernel32.dll SystemSettingsAdminFlows.exe ntdll.dll schtasks.exe wmic.exe +3 more
MD5 Hash
2f698222f435a172c253efd8823a44e9 aa62e73c5be24dbce7c07179faa0da63 b4142bf602459ebb2eafe3727bcf802d e7430c45f8e5d247e58516dccd9d4446 a7940a68ec460c278530e7dac0e763f5 c785093151fa52d84c53dbd0683dcd77 28945b625617cfdcc444b428de0a7a00 c1a7ed250f66368c19abe07ca0283fb5
SHA-1 Hash
e2a10004f3a561b0154558e18220015ed513ee0b 9cab670cd0d11e901cdb3f197aa18f1a6e2930ba 89482b5eb043b53fbf603edf2cbc2764e03a37be 38718bfaf0aa3e87e17d240257e3dd118fb080f7 ffd9a2358ca91092f9971ab9f2371355c29aecfa 8ae1c1869c42daa035032341804aefc3e7f3caf1 40908d3d0c30a4189767fcd3e90d59ea05ee159b 0c47af6e89778d78fdc427897e6790611b2a5478
SHA-256 Hash
91c0c6ab8a1fe428958f33da590bdd52baec868c7011461da8a8972c3d989d42 c7f8c6e833243519cdc8dd327942d62a627fe9c0793d899448938a3f10149481 17526923258ff290ff5ca553248b5952a65373564731a2b8a0cff10e56c293a4 282b7a6d1648e08c02846820324d932ccc224affe94793e9d63ff46818003636 8943356b0288b9463e96d6d0f4f24db068ea47617299071e6124028a8160db9c f0e600bdca5c6a5eae155cc82aad718fe68d7571b7c106774b4c731baa01a50c b44e61de54b97c0492babbf8c56fad0c1f03cb2b839bad8c1c8d3bcd0591a010 13209680c091e180ed1d9a87090be9c10876db403c40638a24b5bc893fd87587 +2 more
IPv4 Address
2.6.1.4 2.6.1.3 2.6.1.2 2.6.1.1

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Exploitation (11)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +6 more
Installation (15)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity M1026 Privileged Account Management +10 more
Command & Control (10)
M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention +5 more
Actions on Objectives (25)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +20 more

Detection Coverage

37 strategies
6/7 stages covered

Reconnaissance (1)

DET0869 Detection of Gather Victim Network Infor...

Weaponization (4)

DET0835 Detection of Email Accounts DET0872 Detection of Malware DET0874 Detection of Server DET0895 Detection of Acquire Infrastructure

Exploitation (7)

DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... DET0294 User Execution – Malicious File via down... DET0364 Behavioral Detection Strategy for WMI Ex... DET0441 Detection of Suspicious Scheduled Task C... +2 more

Installation (9)

DET0157 Detect Kerberoasting Attempts (T1558.003... DET0209 Detection of Registry Query for Environm... DET0307 Detect Access to Unsecured Credential Fi... DET0363 Detection of Credential Dumping from LSA... DET0447 T1136.001 Detection Strategy - Local Acc... +4 more

Command & Control (4)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0261 Detection of Local Data Staging Prior to... DET0327 Multi-event Detection Strategy for RDP-B... DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (12)

DET0021 Behavioral Detection for Service Stop ac... DET0201 Detection Strategy for Hijack Execution... DET0210 Abuse of Domain Accounts DET0215 Detection of Multi-Platform File Encrypt... DET0280 Behavior-Based Registry Modification Det... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Indrik Spider

Type: Unknown Active
Evil Corp Manatee Tempest DEV-0243 UNC2165 GOLD DRAKE +104 more
Infrastructure 27 IOC(s)
50%
Domain
WScript.Shell TEMP.Hermit TEMP.Veles TEMP.Zagros TEMP.Jumper +18
IPv4 Address
2.6.1.4 2.6.1.3 2.6.1.2 2.6.1.1
Artifacts (38)
rocke@live.cn entry.client-xi9AqQZ0.js explorer.exe regsvr32.exe kernel32.dll SystemSettingsAdminFlows.exe +32
Capability
83%
40 technique(s) 52 tool(s)/malware 1 CVE(s)
APT38 Akira Avaddon Babuk Backdoors BitPaymer Black Basta BlackByte +44
T1064? T1086? T1511?
collection
T1074.001
command and control
T1105
credential access
T1003.001 T1552.001 T1555.005 T1558.003
Victim
70%

Targeted Sectors

government financial-services defense telecommunications healthcare critical-infrastructure education manufacturing media energy non-profit hospitality aviation aerospace retail pharmaceutical information-technology think-tank gaming transportation oil-gas legal-services mining chemical maritime utilities nuclear entertainment construction

Targeted Countries

CN US RU IR UA VN IN JP PK TW AU IL GB KR SA AE KP SG BY BR ES DE TR MX PL CA RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1590

Capability (Malware)

APT38 Akira Avaddon
2 Weaponization

Capability (Malware)

APT38 Akira Avaddon
4 Exploitation

Capability (Malware)

APT38 Akira Avaddon
5 Installation

Capability (Malware)

APT38 Akira Avaddon
6 Command & Control

Capability (Malware)

APT38 Akira Avaddon
7 Actions on Objectives

Capability (Techniques)

T1567.002 T1486 T1489

Capability (Malware)

APT38 Akira Avaddon
Leaving Threaticon

This link opens an external site that isn't part of the platform.