Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
TA571 (threat actor)
Risk
79
Critical
17 techniques 40 tools/malware 2 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1589
Gather Victim Identity Information reconnaissance
T1589.002
Email Addresses reconnaissance
›
2 Weaponization
No data
›
3 Delivery
1
T1566
Phishing initial access
›
4 Exploitation
5
T1059
Command and Scripting Interpreter execution
T1204
User Execution execution
T1204.002
Malicious File execution
CVE CVE-2023-48788
CVE CVE-2024-1709
›
5 Installation
No data
›
6 Command & Control
7
T1071
Application Layer Protocol command and control
T1105
Ingress Tool Transfer command and control
T1132
Data Encoding command and control
T1219
Remote Access Tools command and control
T1568
Dynamic Resolution command and control
T1571
Non-Standard Port command and control
T1665
Hide Infrastructure command and control
›
7 Actions on Objectives
4
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1218
System Binary Proxy Execution stealth
T1218.005
Mshta stealth
Stage risk: Critical High Medium None

Tools & Malware (40)

Akira CASTLELOADER ClearFake ClickFix ClickFix technique DarkGate Global IcedID Information Stealers Infostealer Infostealer malware KongTuke LummaC2 Malware MintsLoader NetSupport Netsupport Manager Nexus Odyssey Stealer Payload Payload Phishing campaigns PowerShell PowerShell scripts Process Hollowing Proton Rhadamanthys Rhadamanthys Stealer Rundll32 STOP Satori Snake SocGholish Trojan Valak Windows Command Shell malware distribution mshta mshta.exe phishing

Indicators of Compromise (39)

Domain
karo.ca ekaraj.ir roatancruiseship.com jonanna.com liguys.com naughtycharlotte.com compacta.com theguardshield.com +6 more
Email Address
info@redcanary.com
Filename
mshta.exe 0050-1.dll regsvr32.exe Explorer.exe Useqacaw.dll cmd.exe rundll32.exe DpiChrysler.exe +2 more
SHA-256 Hash
13f0bf908679bea560806fd3c14ef581b3cadbab2ff07a6adf04d97995924707 b0c9d619256fdf220fbb39945fac5a040b5e836f1eae0459b4fcbf2b451420a7 6c6a68da31204cfe93ee86cd85cf668a20259220ad44341b3915396e263e4f86 0a61d734db49fdf92f018532b2d5e512e90ae0b1657c277634aa06e7b71833c4 57897b750473215a2ea6a15070ad5334465019ea4847a2c3c92dae8e5845b2c4 a12045a6177dd32af8b39dea93fa92962ff1716381d0d137dede1fc75ecd2c0c 5d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
IPv4 Address
141.98.80.175 84.200.80.8
URL
http:///gateway/53c06hop.fp0g1 http://google.strike-submit.com/DMCA_Notice.hta http://gestionhqse.com/qd http://gilaniultrasound.com/wfhfxtktx http://jerryposter.com/news/1/255/0

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Delivery (6)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more
Exploitation (11)
M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more
Command & Control (7)
M1021 Restrict Web-Based Content M1030 Network Segmentation M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic +2 more
Actions on Objectives (13)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +8 more

Detection Coverage

17 strategies
5/7 stages covered

Reconnaissance (2)

DET0814 Detection of Email Addresses DET0841 Detection of Gather Victim Identity Info...

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Exploitation (3)

DET0294 User Execution – Malicious File via down... DET0478 User Execution – multi-surface behavior... DET0516 Behavioral Detection of Command and Scri...

Command & Control (7)

DET0039 Detection Strategy for Dynamic Resolutio... DET0060 Detect Ingress Tool Transfers via Behavi... DET0108 Detection Strategy for Data Encoding in... DET0227 Detection Strategy for Non-Standard Port... DET0411 Detection Strategy for Hide Infrastructu... +2 more

Actions on Objectives (4)

DET0081 Detection of Proxy Execution via Trusted... DET0127 Behavioral Detection of Masquerading Acr... DET0378 Behavioral Detection of Obfuscated Files... DET0506 Detecting Mshta-based Proxy Execution vi...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

TA571

Type: Unknown Active
APT28 Pawn Storm Fancy Bear Sednit Snake +9 more
Infrastructure 21 IOC(s)
50%
Domain
karo.ca ekaraj.ir roatancruiseship.com jonanna.com liguys.com +9
IPv4 Address
141.98.80.175 84.200.80.8
URL
http:///gateway/53c06hop.fp0g1 http://google.strike-submit.com/DMCA_Notice.hta http://gestionhqse.com/qd http://gilaniultrasound.com/wfhfxtktx http://jerryposter.com/news/1/255/0
Artifacts (18)
info@redcanary.com mshta.exe 0050-1.dll regsvr32.exe Explorer.exe Useqacaw.dll +12
Capability
50%
17 technique(s) 40 tool(s)/malware 2 CVE(s)
Akira CASTLELOADER ClearFake ClickFix ClickFix technique DarkGate Global IcedID +32
command and control
T1071 T1105 T1132 T1219 +3
execution
T1059 T1204 T1204.002
initial access
T1566
reconnaissance
T1589 T1589.002
Victim
70%

Targeted Sectors

financial-services government defense critical-infrastructure transportation media entertainment

Targeted Countries

BR IR AU IL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589 T1589.002

Capability (Malware)

Akira CASTLELOADER ClearFake
3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

Akira CASTLELOADER ClearFake
4 Exploitation

Capability (Techniques)

T1059 T1204 T1204.002

Capability (Malware)

Akira CASTLELOADER ClearFake
6 Command & Control

Capability (Malware)

Akira CASTLELOADER ClearFake
Leaving Threaticon

This link opens an external site that isn't part of the platform.