Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UAC-0194 (threat actor)
Risk
100
Critical
44 techniques 46 tools/malware 6 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595
Active Scanning reconnaissance
›
2 Weaponization
4
T1583
Acquire Infrastructure resource development
T1584
Compromise Infrastructure resource development
T1588
Obtain Capabilities resource development
T1608
Stage Capabilities resource development
›
3 Delivery
4
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
11
T1047
Windows Management Instrumentation execution
T1053
Scheduled Task/Job execution
T1059
Command and Scripting Interpreter execution
T1204
User Execution execution
T1548
Abuse Elevation Control Mechanism privilege escalation
CVE CVE-2017-0199
CVE CVE-2020-0688
CVE CVE-2020-1472
CVE CVE-2024-43451
CVE CVE-2025-8088
CVE CVE-2026-18577
›
5 Installation
14
T1003
OS Credential Dumping credential access
T1555
Credentials from Password Stores credential access
T1007
System Service Discovery discovery
T1016
System Network Configuration Discovery discovery
T1018
Remote System Discovery discovery
T1033
System Owner/User Discovery discovery
T1049
System Network Connections Discovery discovery
T1057
Process Discovery discovery
T1087
Account Discovery discovery
T1087.001
Local Account discovery
T1482
Domain Trust Discovery discovery
T1098
Account Manipulation persistence
T1543
Create or Modify System Process persistence
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
8
T1113
Screen Capture collection
T1560
Archive Collected Data collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1090
Proxy command and control
T1105
Ingress Tool Transfer command and control
T1021.004
SSH lateral movement
T1210
Exploitation of Remote Services lateral movement
›
7 Actions on Objectives
8
T1112
Modify Registry defense impairment
T1567
Exfiltration Over Web Service exfiltration
T1027
Obfuscated Files or Information stealth
T1036
Masquerading stealth
T1134
Access Token Manipulation stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1218
System Binary Proxy Execution stealth
T1574
Hijack Execution Flow stealth
Stage risk: Critical High Medium None

Tools & Malware (46)

AsyncRAT C2 infrastructure DCSync DIAMONDBACK GitHub Global Google Drive Group Policy HeartCrypt Interception KAZUAR Kazuar LaZagne Malicious files Mango Mimikatz MuddyWater Nexus NjRAT POWERSTATS Payload Payload Phishing campaigns Phishing emails PowerShell PowerShell backdoor PowerShell scripts PureCrypter Remcos Remcos RAT Rundll32 STOCKSTAY STOCKSTAY.MARKETMAKER SparkRAT Tasklist TriBack Loader Trojan Turla Unknown WILDDAY WhatsApp Windows Command Shell Winnti inter mshta phishing

Indicators of Compromise (40)

Domain
TEMP.Zagros FalconFeeds.io republicadominica2025.ip-ddns.com elyeso.ip-ddns.com bitbucket.org Formulario.html STOCKSTAY.STOCKBROKER STOCKSTAY.STOCKMARKET +11 more
Email Address
support@microsoftonlines.com
Filename
websocket-sharp.dll mshta.exe StockMarketNet.exe csc.exe StockMarketSystem.exe Copia.msi spool.dll StockMarketView.exe +7 more
SHA-256 Hash
82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb 45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893 dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22 1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f
IPv4 Address
62.60.226.64

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

36 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (16)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +11 more
Installation (19)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +14 more
Command & Control (14)
M1016 Vulnerability Scanning M1018 User Account Management M1019 Threat Intelligence Program M1020 SSL/TLS Inspection M1026 Privileged Account Management +9 more
Actions on Objectives (19)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +14 more

Detection Coverage

44 strategies
7/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (4)

DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0885 Detection of Compromise Infrastructure DET0895 Detection of Acquire Infrastructure

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (5)

DET0094 Cross-Platform Behavioral Detection of S... DET0345 Detection Strategy for Abuse Elevation C... DET0364 Behavioral Detection Strategy for WMI Ex... DET0478 User Execution – multi-surface behavior... DET0516 Behavioral Detection of Command and Scri...

Installation (14)

DET0007 Detection of Domain Trust Discovery via... DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0096 Account Manipulation Behavior Chain Dete... DET0195 Behavioral Detection of System Network C... +9 more

Command & Control (8)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0118 Exploitation of Remote Services – multi-... DET0346 Detect Screen Capture via Commands and A... DET0444 Detection of Command and Control Over Ap... +3 more

Actions on Objectives (8)

DET0081 Detection of Proxy Execution via Trusted... DET0127 Behavioral Detection of Masquerading Acr... DET0218 Detection Strategy for Hijack Execution... DET0275 Detect Adversary Deobfuscation or Decodi... DET0280 Behavior-Based Registry Modification Det... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UAC-0194

Type: Unknown Active
STOCKSTAY Secret Blizzard VENOMOUS BEAR APT-C-36 deliver malicious .url files +4 more
Infrastructure 20 IOC(s)
50%
Domain
TEMP.Zagros FalconFeeds.io republicadominica2025.ip-ddns.com elyeso.ip-ddns.com bitbucket.org +14
IPv4 Address
62.60.226.64
Artifacts (20)
support@microsoftonlines.com websocket-sharp.dll mshta.exe StockMarketNet.exe csc.exe StockMarketSystem.exe +14
Capability
50%
44 technique(s) 46 tool(s)/malware 6 CVE(s)
AsyncRAT C2 infrastructure DCSync DIAMONDBACK GitHub Global Google Drive Group Policy +38
collection
T1113 T1560
command and control
T1071 T1071.001 T1090 T1105
credential access
T1003 T1555
defense impairment
T1112
Victim
70%

Targeted Sectors

government defense education financial-services telecommunications non-profit manufacturing media oil-gas critical-infrastructure

Targeted Countries

UA AE RU IR CN DE TW US FR VN NG AU SA LB PL NL IT

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

AsyncRAT C2 infrastructure DCSync
2 Weaponization

Capability (Techniques)

T1583 T1584 T1588 T1608

Capability (Malware)

AsyncRAT C2 infrastructure DCSync
3 Delivery

Capability (Malware)

AsyncRAT C2 infrastructure DCSync
4 Exploitation

Capability (Malware)

AsyncRAT C2 infrastructure DCSync
5 Installation

Capability (Malware)

AsyncRAT C2 infrastructure DCSync
6 Command & Control

Capability (Malware)

AsyncRAT C2 infrastructure DCSync
7 Actions on Objectives

Capability (Techniques)

T1567

Capability (Malware)

AsyncRAT C2 infrastructure DCSync
Leaving Threaticon

This link opens an external site that isn't part of the platform.