Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Water Sigbin (threat actor)
Risk
88
Critical
24 techniques 40 tools/malware 4 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1190
Exploit Public-Facing Application initial access
›
4 Exploitation
7
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
CVE CVE-2015-1701
CVE CVE-2017-10271
CVE CVE-2017-3506
CVE CVE-2023-21839
›
5 Installation
4
T1012
Query Registry discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1518.001
Security Software Discovery discovery
›
6 Command & Control
7
T1001
Data Obfuscation command and control
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1095
Non-Application Layer Protocol command and control
T1105
Ingress Tool Transfer command and control
T1132.001
Standard Encoding command and control
T1571
Non-Standard Port command and control
›
7 Actions on Objectives
9
T1112
Modify Registry defense impairment
T1027.010
Command Obfuscation stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1055.002
Portable Executable Injection stealth
T1055.012
Process Hollowing stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1564.003
Hidden Window stealth
T1620
Reflective Code Loading stealth
T1562.001
T1562.001
Stage risk: Critical High Medium None

Tools & Malware (40)

BANSHEE Buhtrap Cobalt Cryptocurrency miner DEADEYE Dark DarkHotel Global Hellsing Hidden Cobra Jackal Lynx Malware Matrix Mirage Naikon Nexus Nitro Payload Payload Poseidon PowerShell PowerShell code Predator PureCrypter PureCrypter Loader Samurai Shamoon Shark Spear-phishing TeamSpy Trojan Tsunami Turla Unknown VICEROY Void XMRIG gcman phishing

Indicators of Compromise (40)

Domain
demo-cloud.space cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao +14 more
Filename
IsSynchronized.exe AddinProcess.exe Tixrgtluffu.dll Powershell.exe Plugin3.dll svchost.exe cvtres.exe Zxpus.dll +3 more
SHA-256 Hash
f4d11b36a844a68bf9718cf720984468583efa6664fc99966115a44b9a20aa33 5D8D6871C3D59D855616603F686713AC48BF2351F6182EA282E1D84CBB15B94F b380b771c7f5c2c26750e281101873772e10c8c1a0d2a2ff0aff1912b569ab93 2e32c5cea00f8e4c808eae806b14585e8672385df7449d2f6575927537ce8884 0bf87b0e65713bf35c8cf54c9fa0015fa629624fd590cb4ba941cd7cdeda8050
IPv4 Address
89.185.85.102 217.182.205.238

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (8)
M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more
Exploitation (9)
M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more
Command & Control (4)
M1030 Network Segmentation M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit
Actions on Objectives (7)
M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +2 more

Detection Coverage

23 strategies
5/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (3)

DET0364 Behavioral Detection Strategy for WMI Ex... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (4)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0209 Detection of Registry Query for Environm... DET0525 System Discovery via Native and Remote U...

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0053 Detect Obfuscated C2 via Network Traffic... DET0060 Detect Ingress Tool Transfers via Behavi... DET0124 Behavior-chain detection for T1132.001 D... DET0227 Detection Strategy for Non-Standard Port... +2 more

Actions on Objectives (8)

DET0106 Behavioral Detection of PE Injection via... DET0128 Detection Strategy for Hidden Windows DET0275 Detect Adversary Deobfuscation or Decodi... DET0280 Behavior-Based Registry Modification Det... DET0300 Detection Strategy for Reflective Code L... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Water Sigbin

Type: Unknown Active
8220 Gang 8220 the 8220 Gang APT10 Bronze Riverside +36 more
Infrastructure 24 IOC(s)
50%
Domain
demo-cloud.space cisa.gov TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad +17
IPv4 Address
89.185.85.102 217.182.205.238
Artifacts (16)
IsSynchronized.exe AddinProcess.exe Tixrgtluffu.dll Powershell.exe Plugin3.dll svchost.exe +10
Capability
50%
24 technique(s) 40 tool(s)/malware 4 CVE(s)
BANSHEE Buhtrap Cobalt Cryptocurrency miner DEADEYE Dark DarkHotel Global +32
T1562.001
command and control
T1001 T1071 T1071.001 T1095 +3
defense impairment
T1112
discovery
T1012 T1057 T1082 T1518.001
Victim
70%

Targeted Sectors

government defense financial-services non-profit energy telecommunications aerospace mining media education information-technology maritime manufacturing think-tank legal-services healthcare pharmaceutical critical-infrastructure chemical utilities hospitality nuclear entertainment

Targeted Countries

US CN GB IN JP DE KR IR RU SA CA TW FR KZ IL TR AU PK VN UA PL AE SG NL BR ES IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

BANSHEE Buhtrap Cobalt
4 Exploitation

Capability (Techniques)

T1047 T1053.005 T1059.001

Capability (Malware)

BANSHEE Buhtrap Cobalt
5 Installation

Capability (Malware)

BANSHEE Buhtrap Cobalt
6 Command & Control

Capability (Malware)

BANSHEE Buhtrap Cobalt
Leaving Threaticon

This link opens an external site that isn't part of the platform.