Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Gamaredon Group (threat actor)
Risk
73
High
70 techniques 3 tools/malware 0 vulnerabilities 200 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
6
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1583.006
Web Services resource development
T1587.003
Digital Certificates resource development
T1588.002
Tool resource development
T1608.001
Upload Malware resource development
›
3 Delivery
1
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
9
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.005
Visual Basic execution
T1106
Native API execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
T1559.001
Component Object Model execution
›
5 Installation
10
T1012
Query Registry discovery
T1016.001
Internet Connection Discovery discovery
T1033
System Owner/User Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1120
Peripheral Device Discovery discovery
T1518.001
Security Software Discovery discovery
T1137
Office Application Startup persistence
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
21
T1005
Data from Local System collection
T1025
Data from Removable Media collection
T1039
Data from Network Shared Drive collection
T1113
Screen Capture collection
T1119
Automated Collection collection
T1001
Data Obfuscation command and control
T1071.001
Web Protocols command and control
T1090
Proxy command and control
T1090.003
Multi-hop Proxy command and control
T1095
Non-Application Layer Protocol command and control
T1102
Web Service command and control
T1102.002
Bidirectional Communication command and control
T1102.003
One-Way Communication command and control
T1105
Ingress Tool Transfer command and control
T1568
Dynamic Resolution command and control
T1568.001
Fast Flux DNS command and control
T1571
Non-Standard Port command and control
T1021.005
VNC lateral movement
T1080
Taint Shared Content lateral movement
T1091
Replication Through Removable Media lateral movement
T1534
Internal Spearphishing lateral movement
›
7 Actions on Objectives
23
T1112
Modify Registry defense impairment
T1685
Disable or Modify Tools defense impairment
T1020
Automated Exfiltration exfiltration
T1041
Exfiltration Over C2 Channel exfiltration
T1491.001
Internal Defacement impact
T1561.001
Disk Content Wipe impact
T1027
Obfuscated Files or Information stealth
T1027.004
Compile After Delivery stealth
T1027.010
Command Obfuscation stealth
T1027.012
LNK Icon Smuggling stealth
T1027.015
Compression stealth
T1027.016
Junk Code Insertion stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1055
Process Injection stealth
T1070.004
File Deletion stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1218.005
Mshta stealth
T1218.011
Rundll32 stealth
T1221
Template Injection stealth
T1480
Execution Guardrails stealth
T1497.001
System Checks stealth
T1564.003
Hidden Window stealth
T1620
Reflective Code Loading stealth
Stage risk: Critical High Medium None

Tools & Malware (3)

PowerPunch Pteranodon QuietSieve

Indicators of Compromise (200)

Domain
skypeupdate.ru rms.admin-ru.ru winupdateloader.ru downloads.email-attachments.ru googlefiles.serveftp.com conhost.myftp.org brokbridge.com parkingdoma.webhop.me +55 more
MD5 Hash
4082a9a608a3b117d055ea168b3ff928 b7e306e05b5cbd6ff64a0803c07cc32d bccdddde154ebc491f45173a8339577b 13b82a280efc92d82753b726227e0fcf 18813bf1bfa68dbb76752c5df32e10ae 09503ceeee5eff7fdbc75bb4e45012e7 994e42c36b90a55a54859bc9b64005f9 036191365577eabe2e9d44a52cfafed5 +129 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (13)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +8 more
Installation (4)
M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program M1051 Update Software M1054 Software Configuration
Command & Control (17)
M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1029 Remote Data Storage M1030 Network Segmentation +12 more
Actions on Objectives (18)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +13 more

Detection Coverage

70 strategies
6/7 stages covered

Weaponization (6)

DET0824 Detection of Upload Malware DET0838 Detection of Virtual Private Server DET0844 Detection of Digital Certificates DET0852 Detection of Tool DET0892 Detection of Domains +1 more

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (9)

DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... DET0224 Detect Abuse of Component Object Model (... DET0294 User Execution – Malicious File via down... +4 more

Installation (10)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0209 Detection of Registry Query for Environm... DET0357 Behavioral Detection of Internet Connect... +5 more

Command & Control (21)

DET0027 Detection of Web Protocol-Based C2 Over... DET0035 Detect Bidirectional Web Service C2 Chan... DET0039 Detection Strategy for Dynamic Resolutio... DET0053 Detect Obfuscated C2 via Network Traffic... DET0054 Internal Spearphishing via Trusted Accou... +16 more

Actions on Objectives (23)

DET0082 Internal Website and System Content Defa... DET0128 Detection Strategy for Hidden Windows DET0140 Behavioral Detection of Malicious File D... DET0168 Virtualization/Sandbox Evasion via Syste... DET0275 Detect Adversary Deobfuscation or Decodi... +18 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Gamaredon Group

Type: Unknown Active
IRON TILDEN Primitive Bear ACTINIUM Armageddon Shuckworm +10 more
Infrastructure 63 IOC(s)
50%
Domain
skypeupdate.ru rms.admin-ru.ru winupdateloader.ru downloads.email-attachments.ru googlefiles.serveftp.com +58
Artifacts (137)
4082a9a608a3b117d055ea168b3ff928 b7e306e05b5cbd6ff64a0803c07cc32d bccdddde154ebc491f45173a8339577b 13b82a280efc92d82753b726227e0fcf 18813bf1bfa68dbb76752c5df32e10ae 09503ceeee5eff7fdbc75bb4e45012e7 +131
Capability
90%
70 technique(s) 3 tool(s)/malware
PowerPunch Pteranodon QuietSieve
collection
T1005 T1025 T1039 T1113 +1
command and control
T1001 T1071.001 T1090 T1090.003 +8
defense impairment
T1112 T1685
discovery
T1012 T1016.001 T1033 T1057 +4
Victim
70%

Targeted Sectors

government

Targeted Countries

IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

PowerPunch Pteranodon QuietSieve
3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

PowerPunch Pteranodon QuietSieve
4 Exploitation

Capability (Malware)

PowerPunch Pteranodon QuietSieve
5 Installation

Capability (Malware)

PowerPunch Pteranodon QuietSieve
6 Command & Control

Capability (Malware)

PowerPunch Pteranodon QuietSieve
7 Actions on Objectives

Capability (Malware)

PowerPunch Pteranodon QuietSieve
Leaving Threaticon

This link opens an external site that isn't part of the platform.