Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Boolka (threat actor)
Risk
81
Critical
29 techniques 40 tools/malware 0 vulnerabilities 39 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
7
T1583.001
Domains resource development
T1583.004
Server resource development
T1584.003
Virtual Private Server resource development
T1587.001
Malware resource development
T1588.002
Tool resource development
T1608
Stage Capabilities resource development
T1608.004
Drive-by Target resource development
›
3 Delivery
2
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
5
T1059.007
JavaScript execution
T1203
Exploitation for Client Execution execution
T1204.002
Malicious File execution
T1569
System Services execution
T1569.002
Service Execution execution
›
5 Installation
4
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1543
Create or Modify System Process persistence
T1543.003
Windows Service persistence
›
6 Command & Control
7
T1005
Data from Local System collection
T1056
Input Capture collection
T1056.001
Keylogging collection
T1213
Data from Information Repositories collection
T1001
Data Obfuscation command and control
T1071.001
Web Protocols command and control
T1210
Exploitation of Remote Services lateral movement
›
7 Actions on Objectives
4
T1041
Exfiltration Over C2 Channel exfiltration
T1565
Data Manipulation impact
T1565.002
Transmitted Data Manipulation impact
T1657
Financial Theft impact
Stage risk: Critical High Medium None

Tools & Malware (40)

AppDomainManager BITS BITS Jobs BMANAGER BMANAGER trojan BeEF framework Beacon ClickOnce Dark Expand Explorer Global Group Policy Havex RAT Hook Interception JamPlus JavaScript scripts Junction MSBuild Malware Matrix Orchard Payload Payload PlugX PowerShell Process Hollowing Pyramid STOP ShadowSyndicate Trojan Unknown ZLib inter netsh phishing rock schtasks systemd

Indicators of Compromise (39)

Domain
boolka.tk boolka24.tk beonlineboo.com beef.beonlineboo.com mainnode.beonlineboo.com node.beonlineboo.com RES.STATION ghcnd-stations.txt +8 more
Filename
WhatsApp.exe msedge.exe chrome.exe SearchApp.exe bmanager.exe bmbackup.exe bmhook.exe bmlog.exe +11 more
MD5 Hash
1ca4cbac895fc3bd12417b77fc6ed31d
SHA-256 Hash
2f10a81bc5a1aad7230cec197af987d00e5008edca205141ac74bc6219ea1802
IPv4 Address
45.182.189.109
URL
http://beef.beonlineboo.com/hook.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

28 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (10)
M1016 Vulnerability Scanning M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation +5 more
Exploitation (11)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +6 more
Installation (9)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1033 Limit Software Installation +4 more
Command & Control (18)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management +13 more
Actions on Objectives (8)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1029 Remote Data Storage M1030 Network Segmentation +3 more

Detection Coverage

29 strategies
6/7 stages covered

Weaponization (7)

DET0825 Detection of Drive-by Target DET0839 Detection of Stage Capabilities DET0852 Detection of Tool DET0854 Detection of Virtual Private Server DET0871 Detection of Server +2 more

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (5)

DET0264 Cross-Platform Detection of JavaScript E... DET0279 Detection Strategy for System Services a... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0421 Detection Strategy for System Services S...

Installation (4)

DET0370 Recursive Enumeration of Files and Direc... DET0525 System Discovery via Native and Remote U... DET0552 Detection of Windows Service Creation or... DET0571 Detection of System Process Creation or...

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0053 Detect Obfuscated C2 via Network Traffic... DET0089 Behavioral Detection of Keylogging Activ... DET0102 Behavioral Detection of Input Capture Ac... DET0118 Exploitation of Remote Services – multi-... +2 more

Actions on Objectives (4)

DET0059 Detection Strategy for Data Manipulation DET0254 Detection Strategy of Transmitted Data M... DET0348 Detection Strategy for Exfiltration Over... DET0495 Detection Strategy for Financial Theft

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Boolka

Type: Unknown Active
Infrastructure 18 IOC(s)
50%
Domain
boolka.tk boolka24.tk beonlineboo.com beef.beonlineboo.com mainnode.beonlineboo.com +11
IPv4 Address
45.182.189.109
URL
http://beef.beonlineboo.com/hook.js
Artifacts (21)
WhatsApp.exe msedge.exe chrome.exe SearchApp.exe bmanager.exe bmbackup.exe +15
Capability
50%
29 technique(s) 40 tool(s)/malware
AppDomainManager BITS BITS Jobs BMANAGER BMANAGER trojan BeEF framework Beacon ClickOnce +32
collection
T1005 T1056 T1056.001 T1213
command and control
T1001 T1071.001
discovery
T1082 T1083
execution
T1059.007 T1203 T1204.002 T1569 +1
Victim
70%

Targeted Sectors

defense financial-services manufacturing retail government hospitality legal-services aviation

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

AppDomainManager BITS BITS Jobs
3 Delivery

Capability (Techniques)

T1189 T1190

Capability (Malware)

AppDomainManager BITS BITS Jobs
4 Exploitation

Capability (Malware)

AppDomainManager BITS BITS Jobs
5 Installation

Capability (Malware)

AppDomainManager BITS BITS Jobs
6 Command & Control

Capability (Malware)

AppDomainManager BITS BITS Jobs
7 Actions on Objectives

Capability (Malware)

AppDomainManager BITS BITS Jobs
Leaving Threaticon

This link opens an external site that isn't part of the platform.