Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Shahid Hemmat (threat actor)

Risk

Medium

10 techniques 40 tools/malware 0 vulnerabilities 35 IOCs 1/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1003.001 - Credential Dumping: Mimikatz

T1021 - Remote Services

T1041 - Exfiltration Over Command and Control Channel

T1059.001 - Command & Scripting Interpreter: PowerShell

T1059.003 - Windows Command Shell

T1070.003 - Indicator Removal on Host

T1077 - Windows Admin Shares (Remote Services)

T1105 - Ingress Tool Transfer

T1115 - Clipboard Data Manipulation

T1193 - Spearphishing Attachment

Stage risk: Critical High Medium None

Tools & Malware (40)

9002 RAT Acronym Agent Tesla Alien Brute Ratel Brute Ratel C4 Carbon Cobalt Cobalt Strike Curator Deputy Embargo Emotet Epic Exodus Explosive Ghost RAT GitHub Global Guard Hunter Knight Liderc MECHANICAL Mimikatz Mole Nexus Phoenix PlugX Poison Ivy RATel Radiant Resident SUNBURST Shamoon Silence Sword Whisper jason malware distribution

Indicators of Compromise (35)

Domain

Vote.gov EveryCRSReport.com Forms.gov PaymentAccuracy.gov Regulations.gov Data.gov CFR-2018-title15-vol2-part744.xml Isis-online.org +24 more

Email Address

jalali.ah@iums.ac.ir UVLRequest@bis.doc.gov ashtiyani@yahoo.com

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Shahid Hemmat

Type: Unknown Active

Yellow Liderc the BM-120 Al Beijing Tianhua International Co Ltd +3 more

Infrastructure 32 IOC(s)

50%

Domain

Vote.gov EveryCRSReport.com Forms.gov PaymentAccuracy.gov Regulations.gov +27

Artifacts (3)

jalali.ah@iums.ac.ir UVLRequest@bis.doc.gov ashtiyani@yahoo.com

Capability

50%

10 technique(s) 40 tool(s)/malware

9002 RAT Acronym Agent Tesla Alien Brute Ratel Brute Ratel C4 Carbon Cobalt +32

T1003.001 - Credential Dumping: Mimikatz T1021 - Remote Services T1041 - Exfiltration Over Command and Control Channel T1059.001 - Command & Scripting Interpreter: PowerShell +6

Victim

70%

Targeted Sectors

defense nuclear aerospace chemical financial-services education government transportation aviation information-technology non-profit energy food-agriculture

Targeted Countries

IR CN US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges