Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UTG-Q-008 (threat actor)

Risk

High

8 techniques 40 tools/malware 1 vulnerabilities 37 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.001

Domains resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

T1056.001

Keylogging collection

T1071

Application Layer Protocol command and control

T1071.004

DNS command and control

T1105

Ingress Tool Transfer command and control

T1568.002

Domain Generation Algorithms command and control

›

7 Actions on Objectives

T1553.002

Code Signing defense impairment

Stage risk: Critical High Medium None

Tools & Malware (40)

Buhtrap Carbon Cobalt DEADEYE Dark DarkHotel Docker Global Hellsing Hidden Cobra Jackal Lynx Malware Matrix Mirage Mythic Naikon Nexus Nitro OilRig Payload Phishing emails Play Poseidon Predator Samurai Shamoon Shark TeamSpy Terraform Trojan Tsunami Turla Unknown VICEROY ValleyRAT Void Winos gcman phishing

Indicators of Compromise (37)

Domain

H8D6PIZ8.txt C92QTRJ3.txt SPYZ5397.txt LTAIFGH3.txt R11HJAMB.txt 08L0VJ9J.txt JS3KFG5M.txt cdn.cookielaw.org +14 more

Email Address

nicadmin@netflix.com amit.kbatra@alumnos.upm.es sm.gomez@upm.es antonio.pastorperales@telefonica.com mario.sanz@upm.es joseignacio.moreno@upm.es abusecomplaints@markmonitor.com

Filename

iexplore.exe TimeBrokerClient.dll

IPv4 Address

172.64.155.119 44.242.131.93 45.57.90.1 44.242.60.85 104.19.178.52 23.246.31.185

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

9 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Command & Control (3)

M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Detection Coverage

8 strategies

4/7 stages covered

Weaponization (1)

DET0892 Detection of Domains

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Command & Control (5)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0400 Behavioral Detection of DNS Tunneling an... DET0419 Detection Strategy for Dynamic Resolutio... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (1)

DET0230 Detect Suspicious or Malicious Code Sign...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UTG-Q-008

Type: Unknown Active

SwimSnake ValleyRAT the Newscaster Team UTG-Q-1000 Void Arachne +19 more

Infrastructure 28 IOC(s)

50%

Domain

H8D6PIZ8.txt C92QTRJ3.txt SPYZ5397.txt LTAIFGH3.txt R11HJAMB.txt +17

IPv4 Address

172.64.155.119 44.242.131.93 45.57.90.1 44.242.60.85 104.19.178.52 +1

Artifacts (9)

nicadmin@netflix.com amit.kbatra@alumnos.upm.es sm.gomez@upm.es antonio.pastorperales@telefonica.com mario.sanz@upm.es joseignacio.moreno@upm.es +3

Capability

50%

8 technique(s) 40 tool(s)/malware 1 CVE(s)

Buhtrap Carbon Cobalt DEADEYE Dark DarkHotel Docker Global +32

collection

T1056.001

command and control

T1071 T1071.004 T1105 T1568.002

defense impairment

T1553.002

initial access

T1566.001

Victim

70%

Targeted Sectors

government defense financial-services non-profit energy telecommunications education aerospace media manufacturing information-technology maritime think-tank mining healthcare pharmaceutical chemical hospitality legal-services nuclear entertainment

Targeted Countries

US CN JP GB IN DE TW KR IR RU SA FR CA IL TR AU KZ PK VN UA PL AE SG NL BR ES IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.001

Capability (Malware)

Buhtrap Carbon Cobalt

Infrastructure

H8D6PIZ8.txt C92QTRJ3.txt SPYZ5397.txt

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Buhtrap Carbon Cobalt

Infrastructure

H8D6PIZ8.txt C92QTRJ3.txt SPYZ5397.txt

6 Command & Control

Capability (Techniques)

T1056.001 T1071 T1071.004 T1105 T1568.002

Capability (Malware)

Buhtrap Carbon Cobalt

Infrastructure

H8D6PIZ8.txt C92QTRJ3.txt SPYZ5397.txt