Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UNC5174 (threat actor)
Risk
100
Critical
40 techniques 40 tools/malware 18 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
4
T1590
Gather Victim Network Information reconnaissance
T1592
Gather Victim Host Information reconnaissance
T1595.001
Scanning IP Blocks reconnaissance
T1595.002
Vulnerability Scanning reconnaissance
›
2 Weaponization
5
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1587.001
Malware resource development
T1608.001
Upload Malware resource development
T1608.002
Upload Tool resource development
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
24
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.004
Unix Shell execution
T1204
User Execution execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2017-0199
CVE CVE-2017-11882
CVE CVE-2017-8759
CVE CVE-2017-9805
CVE CVE-2021-22205
CVE CVE-2023-46747
CVE CVE-2024-1709
CVE CVE-2024-27198
CVE CVE-2024-51378
CVE CVE-2024-51567
CVE CVE-2024-56145
CVE CVE-2024-8190
CVE CVE-2024-8963
CVE CVE-2024-9047
CVE CVE-2025-0994
CVE CVE-2025-20333
CVE CVE-2025-20362
CVE CVE-2025-31324
›
5 Installation
8
T1003.001
LSASS Memory credential access
T1003.002
Security Account Manager credential access
T1087.001
Local Account discovery
T1087.002
Domain Account discovery
T1482
Domain Trust Discovery discovery
T1098.007
Additional Local or Domain Groups persistence
T1136.001
Local Account persistence
T1505.003
Web Shell persistence
›
6 Command & Control
6
T1005
Data from Local System collection
T1008
Fallback Channels command and control
T1105
Ingress Tool Transfer command and control
T1132.001
Standard Encoding command and control
T1573.001
Symmetric Cryptography command and control
T1570
Lateral Tool Transfer lateral movement
›
7 Actions on Objectives
9
T1041
Exfiltration Over C2 Channel exfiltration
T1036.005
Match Legitimate Resource Name or Location stealth
T1078
Valid Accounts stealth
T1078.003
Local Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1574.001
DLL stealth
T1620
Reflective Code Loading stealth
T1070.001
T1070.001
T1562.001
T1562.001
Stage risk: Critical High Medium None

Tools & Malware (40)

AppSov.exe BITS BITS Jobs Backdoors ClickOnce Cobalt Cobalt Strike ConnectWise GOREshell GitHub Global Group Policy Interception Malware NetDraft Nexus Nimbo-C2 Open-source tools PULSEPACK Payload Payload PowerShell Process Hollowing SNAPPYBEE SNOWLIGHT SYLVANITE ScatterBrain ScreenConnect SentinelOne ShadowPad Stowaway Systemd UAT-8302 VOLTZITE VShell Windows Command Shell cmd.exe phishing schtasks web shell

Indicators of Compromise (40)

Domain
cloud.trendav.co trendav.vip chrome-online.site downloads.trendav.vip tatacom.duckdns.org news.imaginerjp.com dscriy.chtq.net network.oossafe.com +7 more
Filename
adconnectdump.py cmd.exe explorer.exe net.exe nltest.exe run.bat AppSov.exe glib-2.0.dll +6 more
IPv4 Address
143.244.137.54 103.248.61.36 45.13.199.209 142.93.212.42 142.93.214.219 107.173.111.26 43.247.135.53 103.30.76.206 +3 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (17)
M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1026 Privileged Account Management +12 more
Installation (12)
M1017 User Training M1018 User Account Management M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +7 more
Command & Control (3)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1057 Data Loss Prevention
Actions on Objectives (16)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +11 more

Detection Coverage

38 strategies
7/7 stages covered

Reconnaissance (4)

DET0817 Detection of Scanning IP Blocks DET0826 Detection of Gather Victim Host Informat... DET0867 Detection of Vulnerability Scanning DET0869 Detection of Gather Victim Network Infor...

Weaponization (5)

DET0824 Detection of Upload Malware DET0834 Detection of Upload Tool DET0838 Detection of Virtual Private Server DET0872 Detection of Malware DET0892 Detection of Domains

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (6)

DET0202 Behavioral Detection of Windows Command... DET0384 Behavioral Detection of Unix Shell Execu... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... +1 more

Installation (8)

DET0007 Detection of Domain Trust Discovery via... DET0085 Credential Dumping from SAM via Registry... DET0129 Domain Account Enumeration Across Platfo... DET0303 Local Account Enumeration Across Host Pl... DET0310 Suspicious Addition to Local or Domain G... +3 more

Command & Control (6)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0124 Behavior-chain detection for T1132.001 D... DET0143 Detection Strategy for Encrypted Channel... DET0183 Detection Strategy for Lateral Tool Tran... DET0380 Detection of Local Data Collection Prior... +1 more

Actions on Objectives (7)

DET0201 Detection Strategy for Hijack Execution... DET0275 Detect Adversary Deobfuscation or Decodi... DET0300 Detection Strategy for Reflective Code L... DET0347 Detection Strategy for Masquerading via... DET0348 Detection Strategy for Exfiltration Over... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UNC5174

Type: Unknown Active
Uteus UNC5174 by Mandiant GOREVERSE Mysterious Elephant STAC6451 was published +2 more
Infrastructure 26 IOC(s)
50%
Domain
cloud.trendav.co trendav.vip chrome-online.site downloads.trendav.vip tatacom.duckdns.org +10
IPv4 Address
143.244.137.54 103.248.61.36 45.13.199.209 142.93.212.42 142.93.214.219 +6
Artifacts (14)
adconnectdump.py cmd.exe explorer.exe net.exe nltest.exe run.bat +8
Capability
50%
40 technique(s) 40 tool(s)/malware 18 CVE(s)
AppSov.exe BITS BITS Jobs Backdoors ClickOnce Cobalt Cobalt Strike ConnectWise +32
T1070.001 T1562.001
collection
T1005
command and control
T1008 T1105 T1132.001 T1573.001
credential access
T1003.001 T1003.002
Victim
70%

Targeted Sectors

government defense transportation critical-infrastructure telecommunications manufacturing media financial-services information-technology maritime education retail aerospace aviation energy oil-gas healthcare mining

Targeted Countries

CN US IN BR FR AU PL IL KP CA JP AE UA IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Malware)

AppSov.exe BITS BITS Jobs
2 Weaponization

Capability (Malware)

AppSov.exe BITS BITS Jobs
3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

AppSov.exe BITS BITS Jobs
4 Exploitation

Capability (Malware)

AppSov.exe BITS BITS Jobs
5 Installation

Capability (Malware)

AppSov.exe BITS BITS Jobs
6 Command & Control

Capability (Malware)

AppSov.exe BITS BITS Jobs
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

AppSov.exe BITS BITS Jobs
Leaving Threaticon

This link opens an external site that isn't part of the platform.