Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Adrastea (threat actor)

Risk

Medium

3 techniques 40 tools/malware 0 vulnerabilities 39 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

T1071

Application Layer Protocol command and control

›

7 Actions on Objectives

T1094

T1179

Stage risk: Critical High Medium None

Tools & Malware (40)

AcidRain Alphv Ares Atmosphere BRAIN Crimson Deputy Emotet Flame Ghost RAT GitHub Global Globe Guard HellCat Ransomware Infostealer Jupiter Leverage Malware Matrix Nemesis OrBit PHOTO Payload Payload PlugX Quasar Quasar RAT Royal SUNBURST Skipper Solar SolarWinds Soul Sugar Telegram Zeus inter malware distribution rock

Indicators of Compromise (39)

Domain

20.Roberts 6.Piazza 7.Capraro 8.Beersma 9.Boehm 10.Yoeli 11.Ready 12.Milinski +17 more

Filename

2.vbs wscript.exe vbs.bin

SHA-256 Hash

dda76af8d395dccbe545d1229617376570b747b0bacfe5582b646f42937eb732 970df6100d8375af169bb259df2c7bb1ad641294e34ed57dc3ad02a38371b4c7 66cf6a1cda9e240560d3dd09a638f88527ba60dc15d9d5716e63c8ad1df5e954 7b8b820eea5aaf7759404bcf53ca9979080ea061ab4523593b1f5e2e8db6f5cc 515013f5f20260e6091e6bb787fbca051fd20f44c8b9187e7753834c81d17236 c109d3c4e28ff454f699952760d5388253dae0aa648ae4b3eff9bc485d37642f fe7d9cabbc9a0e8405420dcaa94fab2f69524b7cf93b04c455c7c2aade461193 fd456a86043c25634f431e85566fa93a360c2a70a8b375582443b2ed567e7d70 +2 more

IPv4 Address

208.115.226.68

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

2 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Detection Coverage

1 strategies

1/7 stages covered

Command & Control (1)

DET0444 Detection of Command and Control Over Ap...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Adrastea

Type: Unknown Active

Jupiter XV the

Infrastructure 26 IOC(s)

50%

Domain

20.Roberts 6.Piazza 7.Capraro 8.Beersma 9.Boehm +20

IPv4 Address

208.115.226.68

Artifacts (13)

2.vbs wscript.exe vbs.bin dda76af8d395dccbe545d1229617376570b747b0bacfe5582b646f42937eb732 970df6100d8375af169bb259df2c7bb1ad641294e34ed57dc3ad02a38371b4c7 66cf6a1cda9e240560d3dd09a638f88527ba60dc15d9d5716e63c8ad1df5e954 +7

Capability

50%

3 technique(s) 40 tool(s)/malware

AcidRain Alphv Ares Atmosphere BRAIN Crimson Deputy Emotet +32

T1094 T1179

command and control

T1071

Victim

70%

Targeted Sectors

defense healthcare government aerospace non-profit financial-services critical-infrastructure food-agriculture transportation manufacturing

Targeted Countries

CN IR IL SA US TW GB NG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

6 Command & Control

Capability (Techniques)

T1071

Capability (Malware)

AcidRain Alphv Ares

Infrastructure

20.Roberts 6.Piazza 7.Capraro