Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
CeranaKeeper (threat actor)
Risk
81
Critical
26 techniques 46 tools/malware 0 vulnerabilities 39 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
4
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1585.003
Cloud Accounts resource development
T1587.001
Malware resource development
›
3 Delivery
1
T1566.002
Spearphishing Link initial access
›
4 Exploitation
6
T1059
Command and Scripting Interpreter execution
T1072
Software Deployment Tools execution
T1106
Native API execution
T1204
User Execution execution
T1204.002
Malicious File execution
T1204.004
Malicious Copy and Paste execution
›
5 Installation
1
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
10
T1005
Data from Local System collection
T1039
Data from Network Shared Drive collection
T1074.001
Local Data Staging collection
T1560.001
Archive via Utility collection
T1071.001
Web Protocols command and control
T1090.001
Internal Proxy command and control
T1102.002
Bidirectional Communication command and control
T1132.002
Non-Standard Encoding command and control
T1573.001
Symmetric Cryptography command and control
T1573.002
Asymmetric Cryptography command and control
›
7 Actions on Objectives
4
T1567.002
Exfiltration to Cloud Storage exfiltration
T1036.005
Match Legitimate Resource Name or Location stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1574.002
T1574.002
Stage risk: Critical High Medium None

Tools & Malware (46)

AzCopy Backdoors Bookworm Camaro Dragon Careto China Chopper ClickFix ClickFix/fakeCAPTCHA Cobalt Cobalt Strike Crisis Custom backdoors Custom malware Custom tools DOPLUGS Expand GRAYRABBIT GitHub Global Havex RAT Hodur HoneyMyte Korplug Leverage MQsTTang Matrix Microsoft OneDrive Microsoft OneDrive executable Nexus OilRig OneDoor OneDoor backdoor OneDrive OneDrive.exe PUBLOAD PlugX PlugX components Poison Ivy Pubload backdoor TONESHELL TeamViewer Trojan Unknown WavyExfiller Winrar phishing

Indicators of Compromise (39)

Domain
demo-cloud.space 5.97.0.mas.8d580ada.awus config.ini uvfr4ep.com dropboxflop.pyc errors.log Agent.VJO Agent.AGT +9 more
Email Address
threatintel@eset.com
Filename
SearchApp.exe Update.exe avk.dll EACore.dll TurboActivate.dll rar.exe oneDrive.exe OneDrive.exe +1 more
SHA-256 Hash
6655C5686B9B0292CF5121FC6346341BB888704B421A85A15011456A9A2C192A B15BA83681C4D2C2716602615288B7E64A1D4A9F4805779CEBDF5E6C2399AFB5 B25C79BA507A256C9CA12A9BD34DEF6A33F9C087578C03D083D7863C708ECA21 E6AB24B826C034A6D9E152673B91159201577A3A9D626776F95222F01B7C21DB DAFAD19900FFF383C2790E017C958A1E92E84F7BB159A2A7136923B715A4C94F 3F81D1E70D9EE39C83B582AC3BCC1CDFE038F5DA31331CDBCD4FF1A2D15BB7C8 24E12B8B1255DF4E6619ED1A6AE1C75B17341EEF7418450E661B74B144570017 E7B6164B6EC7B7552C93713403507B531F625A8C64D36B60D660D66E82646696 +1 more
IPv4 Address
172.67.165.197 104.21.81.233 103.27.202.185

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (5)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1054 Software Configuration
Exploitation (18)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +13 more
Command & Control (6)
M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit +1 more
Actions on Objectives (4)
M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1045 Code Signing

Detection Coverage

25 strategies
6/7 stages covered

Weaponization (4)

DET0838 Detection of Virtual Private Server DET0846 Detection of Cloud Accounts DET0872 Detection of Malware DET0892 Detection of Domains

Delivery (1)

DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (6)

DET0223 Detection of Adversary Abuse of Software... DET0294 User Execution – Malicious File via down... DET0340 User Execution – Malicious Copy & Paste... DET0478 User Execution – multi-surface behavior... DET0516 Behavioral Detection of Command and Scri... +1 more

Installation (1)

DET0365 Detect Registry and Startup Folder Persi...

Command & Control (10)

DET0027 Detection of Web Protocol-Based C2 Over... DET0035 Detect Bidirectional Web Service C2 Chan... DET0075 Internal Proxy Behavior via Lateral Host... DET0143 Detection Strategy for Encrypted Channel... DET0261 Detection of Local Data Staging Prior to... +5 more

Actions on Objectives (3)

DET0275 Detect Adversary Deobfuscation or Decodi... DET0347 Detection Strategy for Masquerading via... DET0570 Detection Strategy for Exfiltration to C...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

CeranaKeeper

Type: Unknown Active
Careto Earth Preta Stately Taurus Mustang Panda ClickFix +1 more
Infrastructure 20 IOC(s)
50%
Domain
demo-cloud.space 5.97.0.mas.8d580ada.awus config.ini uvfr4ep.com dropboxflop.pyc +12
IPv4 Address
172.67.165.197 104.21.81.233 103.27.202.185
Artifacts (19)
threatintel@eset.com SearchApp.exe Update.exe avk.dll EACore.dll TurboActivate.dll +13
Capability
50%
26 technique(s) 46 tool(s)/malware
AzCopy Backdoors Bookworm Camaro Dragon Careto China Chopper ClickFix ClickFix/fakeCAPTCHA +38
T1574.002
collection
T1005 T1039 T1074.001 T1560.001
command and control
T1071.001 T1090.001 T1102.002 T1132.002 +2
execution
T1059 T1072 T1106 T1204 +2
Victim
70%

Targeted Sectors

government non-profit healthcare manufacturing think-tank telecommunications defense maritime media aviation education gaming

Targeted Countries

CN JP TW VN AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

AzCopy Backdoors Bookworm
3 Delivery

Capability (Techniques)

T1566.002

Capability (Malware)

AzCopy Backdoors Bookworm
4 Exploitation

Capability (Malware)

AzCopy Backdoors Bookworm
5 Installation

Capability (Techniques)

T1547.001

Capability (Malware)

AzCopy Backdoors Bookworm
6 Command & Control

Capability (Malware)

AzCopy Backdoors Bookworm
7 Actions on Objectives

Capability (Techniques)

T1567.002

Capability (Malware)

AzCopy Backdoors Bookworm
Leaving Threaticon

This link opens an external site that isn't part of the platform.