Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UAT-5394 (threat actor)

Risk

High

13 techniques 69 tools/malware 0 vulnerabilities 38 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1059.005

Visual Basic execution

›

5 Installation

T1003.004

LSA Secrets credential access

T1069.003

Cloud Groups discovery

›

6 Command & Control

T1071.003

Mail Protocols command and control

T1091

Replication Through Removable Media lateral movement

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1027

Obfuscated Files or Information stealth

T1055

Process Injection stealth

T1043

T1076

Stage risk: Critical High Medium None

Tools & Malware (69)

Amadey AppDomainManager AppleSeed backdoor AutoIt BANSHEE BITS BITS Jobs BITTERSWEET BabyShark Black Banshee CSPY Downloader ClickOnce Clop FlowerPower Gh0st RAT GitHub Global Gold Dragon Grease Group Policy Havex RAT Hook Interception JamPlus KGH_SPY KPortScan KimJongRAT Kimsuky Living off the Land MSBuild MailPassView Mechanical Mimikatz MoonPeak MyDogs Network Password Recovery Nexus PowerShell ProcDump Process Hollowing PsExec Qilin Qilin Ransomware QuasarRAT ReconShark Remote Desktop PassView RftRAT Rogue SHARPEXT SWEETDROP SmallTiger SniffPass Spear-phishing TODDLERSHARK TRANSLATEXT Thallium Trojan Troll Stealer UAT-7290 UAT-8302 Unknown VENOMBITE Velvet Chollima WebBrowserPassView XenoRAT netsh phishing systemd xRAT

Indicators of Compromise (38)

Domain

demo-cloud.space Hunt.io Snort.org pumaria.store yoiroyse.store servers.jpg calc.txt

Filename

msimg32.dll

SHA-256 Hash

58fdc1b6ce4744d6331f8e2efc4652d754e803cae4cc16101fc78438184995e6 a80a35649f638049244a06dd4fb6eca4de0757ef566bfbe1affe1c8bf1d96b04 f4aa4c6942a87087530494cba770a1dcbc263514d874f12ba93a64b1edbae21c 0ed643a30a82daacecfec946031143b962f693104bcb7087ec6bda09ade0f3cb 148c69a7a1e06dc06e52db5c3f5895de6adc3d79498bc3ccc2cbd8fdf28b2070 1ad43ddfce147c1ec71b37011d522c11999a974811fead11fee6761ceb920b10 458641936e2b41c425161a9b892d2aa08d1de2bc0db446f214b5f87a6a506432 8a4fbcdec5c08e6324e3142f8b8c41da5b8e714b9398c425c47189f17a51d07b +13 more

IPv4 Address

104.194.152.251 45.87.153.79 45.95.11.52 80.71.157.55 27.255.81.118 159.100.29.122 95.164.86.148 167.88.173.173 +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

16 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (7)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program +2 more

Installation (3)

M1017 User Training M1026 Privileged Account Management M1027 Password Policies

Command & Control (5)

M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program

Actions on Objectives (7)

M1017 User Training M1026 Privileged Account Management M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1047 Audit +2 more

Detection Coverage

11 strategies

5/7 stages covered

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0076 Behavioral Detection of Visual Basic Exe... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (2)

DET0251 Behavioral Detection of Cloud Group Enum... DET0437 Detection of LSA Secrets Dumping via Reg...

Command & Control (2)

DET0135 Detection of Mail Protocol-Based C2 Acti... DET0301 Removable Media Execution Chain Detectio...

Actions on Objectives (3)

DET0348 Detection Strategy for Exfiltration Over... DET0378 Behavioral Detection of Obfuscated Files... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UAT-5394

Type: Unknown Active

APT-C-55 Black Banshee Velvet Chollima ta427 RftRAT +10 more

Infrastructure 16 IOC(s)

50%

Domain

demo-cloud.space Hunt.io Snort.org pumaria.store yoiroyse.store +2

IPv4 Address

104.194.152.251 45.87.153.79 45.95.11.52 80.71.157.55 27.255.81.118 +4

Artifacts (22)

msimg32.dll 58fdc1b6ce4744d6331f8e2efc4652d754e803cae4cc16101fc78438184995e6 a80a35649f638049244a06dd4fb6eca4de0757ef566bfbe1affe1c8bf1d96b04 f4aa4c6942a87087530494cba770a1dcbc263514d874f12ba93a64b1edbae21c 0ed643a30a82daacecfec946031143b962f693104bcb7087ec6bda09ade0f3cb 148c69a7a1e06dc06e52db5c3f5895de6adc3d79498bc3ccc2cbd8fdf28b2070 +16

Capability

50%

13 technique(s) 69 tool(s)/malware

Amadey AppDomainManager AppleSeed backdoor AutoIt BANSHEE BITS BITS Jobs BITTERSWEET +61

T1043 T1076

command and control

T1071.003

credential access

T1003.004

discovery

T1069.003

Victim

70%

Targeted Sectors

government education telecommunications defense manufacturing energy healthcare nuclear transportation think-tank critical-infrastructure

Targeted Countries

KP KR CN US JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

Amadey AppDomainManager AppleSeed backdoor

Infrastructure

demo-cloud.space Hunt.io Snort.org

4 Exploitation

Capability (Techniques)

T1059.001 T1059.005

Capability (Malware)

Amadey AppDomainManager AppleSeed backdoor

Infrastructure

demo-cloud.space Hunt.io Snort.org

5 Installation

Capability (Techniques)

T1003.004 T1069.003

Capability (Malware)

Amadey AppDomainManager AppleSeed backdoor

Infrastructure

demo-cloud.space Hunt.io Snort.org

6 Command & Control

Capability (Techniques)

T1071.003 T1091

Capability (Malware)

Amadey AppDomainManager AppleSeed backdoor

Infrastructure

demo-cloud.space Hunt.io Snort.org

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Amadey AppDomainManager AppleSeed backdoor

Infrastructure

demo-cloud.space Hunt.io Snort.org