Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TA2719 (threat actor)

Risk

Medium

3 techniques 40 tools/malware 0 vulnerabilities 10 IOCs 1/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1553

Subvert Trust Controls defense impairment

T1564

Hide Artifacts stealth

T1622

Debugger Evasion stealth

Stage risk: Critical High Medium None

Tools & Malware (40)

9002 RAT ALPHV Agent Tesla Anchor AsyncRAT BLACKCOFFEE BlackCat Cobalt DROPSHOT Dark Derusbi Destructive Malware Enfal Ghost RAT GitHub Jackal Malicious files Malware Mimikatz NanoCore Nanocore RAT Payload Phishing campaigns PittyTiger Poison Ivy Remote access trojans Royal SUNBURST SVCStealer Sednit Sofacy SolarWinds TEARDROP Trojans Unknown Vendetta Void Wicked phishing phishing emails

Indicators of Compromise (10)

Domain

megaida123.ddns.net

Filename

pdf.iso Document.iso

SHA-1 Hash

0f229c0e42bfe7ca736a14023836d65baa941ed2

SHA-256 Hash

161eaa18e31aec64433158da81eea99e518659e06ed36e2052508a7cbeb688c6 6489bbcdd9e0588d6e4ee63e5f66346e7d690ac3b7ee5249436fb1db8abc6453 1b93790c002d5216822277c6b8abb36dfd5daf9ebc14553135c992f64f8d949e bcc0be90110b3b960230a366f1be67904704f87645ff5fde69536432d73feace

IPv4 Address

194.5.98.8 172.111.188.199

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

9 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Actions on Objectives (9)

M1013 Application Developer Guidance M1024 Restrict Registry Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1033 Limit Software Installation +4 more

Detection Coverage

3 strategies

1/7 stages covered

Actions on Objectives (3)

DET0371 Detection Strategy for Debugger Evasion... DET0452 Detect Subversion of Trust Controls via... DET0502 Detection Strategy for Hidden Artifacts...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

TA2719

Type: Unknown Active

a mortgage closing scam APT28 Pawn Storm Fancy Bear Sednit

Infrastructure 3 IOC(s)

50%

Domain

megaida123.ddns.net

IPv4 Address

194.5.98.8 172.111.188.199

Artifacts (7)

pdf.iso Document.iso 0f229c0e42bfe7ca736a14023836d65baa941ed2 161eaa18e31aec64433158da81eea99e518659e06ed36e2052508a7cbeb688c6 6489bbcdd9e0588d6e4ee63e5f66346e7d690ac3b7ee5249436fb1db8abc6453 1b93790c002d5216822277c6b8abb36dfd5daf9ebc14553135c992f64f8d949e +1

Capability

50%

3 technique(s) 40 tool(s)/malware

9002 RAT ALPHV Agent Tesla Anchor AsyncRAT BLACKCOFFEE BlackCat Cobalt +32

defense impairment

T1553

stealth

T1564 T1622

Victim

70%

Targeted Sectors

government defense aerospace energy non-profit think-tank financial-services retail

Targeted Countries

TW US SA NL ES IT IR IL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges