Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
LabHost (threat actor)
Risk
58
High
7 techniques 40 tools/malware 2 vulnerabilities 40 IOCs 3/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
3
T1059
Command and Scripting Interpreter execution
CVE CVE-2023-23397
CVE CVE-2023-38831
›
5 Installation
No data
›
6 Command & Control
2
T1005
Data from Local System collection
T1071
Application Layer Protocol command and control
›
7 Actions on Objectives
4
T1014
Rootkit stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1211
Exploitation for Stealth stealth
T1562.001
T1562.001
Stage risk: Critical High Medium None

Tools & Malware (40)

BlackCat Cobalt Dark Expand Global GoldDigger Hancitor Hunter LabRat LabSend Leverage Malware Matrix MuddyWater Phishing Kit Phishing campaigns Phishing kits Phishing templates Phoenix Pink Qilin Qilin Ransomware RansomHub Route STOP SUNBURST ShadowSyndicate SideWinder SilabRAT Spear-phishing Spear-phishing emails Sting Telegram Telegram channels Trojan Trojans Unknown VietCredCare evilginx2 phishing

Indicators of Compromise (40)

Domain
online-db-batch.top namesilo.com 2fa-royalbank.com rbc-secure-serv.com rbcbanking-auth.ca nic.ru lab-host.ru rbclaimreturn.com +11 more
Filename
browserCheck.js loader-twofactor.js mask.js splitter.js tracking.js Thumbs.db a.js async.js +6 more
MD5 Hash
fe6b5bee1c6a8bcd5465abebf0f78c94
SHA-1 Hash
cda695baad4be4f6067195395997360337a43d6f
IPv4 Address
188.114.96.1 185.113.8.38 159.253.120.116 185.178.208.34 45.148.244.237

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Exploitation (9)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more
Command & Control (3)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1057 Data Loss Prevention
Actions on Objectives (7)
M1019 Threat Intelligence Program M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1045 Code Signing M1048 Application Isolation and Sandboxing +2 more

Detection Coverage

6 strategies
3/7 stages covered

Exploitation (1)

DET0516 Behavioral Detection of Command and Scri...

Command & Control (2)

DET0380 Detection of Local Data Collection Prior... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (3)

DET0347 Detection Strategy for Masquerading via... DET0377 Detection of Kernel/User-Level Rootkit B... DET0595 Detection Strategy for Exploitation for...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

LabHost

Type: Unknown Active
LabRat real-time victim control module SnappyClient YoroTrooper
Infrastructure 24 IOC(s)
50%
Domain
online-db-batch.top namesilo.com 2fa-royalbank.com rbc-secure-serv.com rbcbanking-auth.ca +14
IPv4 Address
188.114.96.1 185.113.8.38 159.253.120.116 185.178.208.34 45.148.244.237
Artifacts (16)
browserCheck.js loader-twofactor.js mask.js splitter.js tracking.js Thumbs.db +10
Capability
50%
7 technique(s) 40 tool(s)/malware 2 CVE(s)
BlackCat Cobalt Dark Expand Global GoldDigger Hancitor Hunter +32
T1562.001
collection
T1005
command and control
T1071
execution
T1059
Victim
70%

Targeted Sectors

financial-services government defense manufacturing aviation critical-infrastructure media retail healthcare telecommunications transportation education

Targeted Countries

GB US CA RU SG AU VN CN FR IT RO EG BR NL IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1059

Capability (Malware)

BlackCat Cobalt Dark
6 Command & Control

Capability (Techniques)

T1005 T1071

Capability (Malware)

BlackCat Cobalt Dark
Leaving Threaticon

This link opens an external site that isn't part of the platform.