Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Tstark (threat actor)

Risk

High

18 techniques 42 tools/malware 0 vulnerabilities 29 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1190

Exploit Public-Facing Application initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1203

Exploitation for Client Execution execution

›

5 Installation

T1133

External Remote Services persistence

›

6 Command & Control

T1071.002

File Transfer Protocols command and control

›

7 Actions on Objectives

T1048

Exfiltration Over Alternative Protocol exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1567.001

Exfiltration to Code Repository exfiltration

T1486

Data Encrypted for Impact impact

T1657

Financial Theft impact

T1140

Deobfuscate/Decode Files or Information stealth

T1060

T1168

Stage risk: Critical High Medium None

Tools & Malware (42)

AsyncRAT Backdoors BlackCat BlackCat (Royal Ransomware) BlackSuit ClickFix Cobalt Cobalt Strike Conti Dark Disco GhostWeaver Global GrandAgent (GrimAgent) GrimAgent HELLOKITTY KongTuke Leverage LockBit Lynx MintsLoader Mythic Nokoyawa Ransomware PLAY Payload Payload Phishing campaigns Phishing emails Phobos PowerShell Ransomware variants Royal Royal Ransomware Ryuk SocGholish Stealc TrickBot Trigona Trojan Unknown curl phishing

Indicators of Compromise (29)

Domain

sesraw.com Temp.Zagros TEMP.Akapav TEMP.Jumper TEMP.Periscope TEMP.Hex 2.php temp.sh +18 more

Email Address

disco-team@stealthemail.com

Filename

update.js

SHA-256 Hash

fb0238b388d9448a6b36aca4e6a9e4fbcbac3afc239cb70251778d40351b5765

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (12)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +7 more

Installation (5)

M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1030 Network Segmentation +5 more

Detection Coverage

16 strategies

5/7 stages covered

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0516 Behavioral Detection of Command and Scri...

Installation (1)

DET0354 Behavior-chain detection for T1133 Exter...

Command & Control (1)

DET0416 Detection of File Transfer Protocol-Base...

Actions on Objectives (6)

DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0275 Detect Adversary Deobfuscation or Decodi... DET0318 Detection Strategy for Exfiltration to C... DET0495 Detection Strategy for Financial Theft +1 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Tstark

Type: Unknown Active

LandUpdate808 tracking Royal Ransomware BlackCat Gookee +4 more

Infrastructure 26 IOC(s)

50%

Domain

sesraw.com Temp.Zagros TEMP.Akapav TEMP.Jumper TEMP.Periscope +21

Artifacts (3)

disco-team@stealthemail.com update.js fb0238b388d9448a6b36aca4e6a9e4fbcbac3afc239cb70251778d40351b5765

Capability

50%

18 technique(s) 42 tool(s)/malware

AsyncRAT Backdoors BlackCat BlackCat (Royal Ransomware) BlackSuit ClickFix Cobalt Cobalt Strike +34

T1060 T1168

command and control

T1071.002

execution

T1059 T1059.001 T1059.003 T1203

exfiltration

T1048 T1567 T1567.001

Victim

70%

Targeted Sectors

financial-services healthcare government education telecommunications defense critical-infrastructure manufacturing retail energy media food-agriculture non-profit information-technology hospitality mining oil-gas aerospace maritime nuclear entertainment gaming construction transportation

Targeted Countries

UA CN RU IN GB US DE KP IR IT PK BY PL TW CA AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1190 T1566 T1566.001

Capability (Malware)

AsyncRAT Backdoors BlackCat

Infrastructure

sesraw.com Temp.Zagros TEMP.Akapav

4 Exploitation

Capability (Techniques)

T1059 T1059.001 T1059.003 T1203

Capability (Malware)

AsyncRAT Backdoors BlackCat

Infrastructure

sesraw.com Temp.Zagros TEMP.Akapav

5 Installation

Capability (Techniques)

T1133

Capability (Malware)

AsyncRAT Backdoors BlackCat

Infrastructure

sesraw.com Temp.Zagros TEMP.Akapav

6 Command & Control

Capability (Techniques)

T1071.002

Capability (Malware)

AsyncRAT Backdoors BlackCat

Infrastructure

sesraw.com Temp.Zagros TEMP.Akapav

7 Actions on Objectives

Capability (Techniques)

T1048 T1567 T1567.001 T1486 T1657

Capability (Malware)

AsyncRAT Backdoors BlackCat

Infrastructure

sesraw.com Temp.Zagros TEMP.Akapav