Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

BrazenBamboo (threat actor)

Risk

High

4 techniques 51 tools/malware 1 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1203

Exploitation for Client Execution execution

CVE CVE-2019-3396

›

5 Installation

T1003.001

LSASS Memory credential access

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

Stage risk: Critical High Medium None

Tools & Malware (51)

AMOS BLACKCOFFEE Backdoors BeaverTail C2 infrastructure CALENDAR CROSSWALK Camaro Dragon China Chopper CloudChat Cobalt Cobalt Strike DEEPDATA DEEPPOST Double Dragon DragonEgg FunnySwitch HIGHNOON HUI Loader HZ RAT Infostealer LATELUNCH LIGHTSPY LightSpy MESSAGETAP Meterpreter Mimikatz MoonBounce MoonWalk PRIVATELOG Payload PipeMon RedXOR SUNBURST SWEETCANDLE SentinelOne SerialVlogger ShadowPad SideWalk Singularity SolarWinds Telegram Trojan Voldemort WINTERLOVE Winnti WyrmSpy certutil crackshot gh0st RAT shadowhammer

Indicators of Compromise (40)

Domain

TMP.Lapis readme.txt Hunt.io mod.dat ADORE.XSEC Connect.pkg manifest.json macOS.Bkdr.Activator +5 more

Filename

localupload.exe ffmpeg.dll data.dll frame.dll vertdll.dll msenvico.dll iumdll.dll deepdata.zip

MD5 Hash

533297a7084039bf6bda702b752e6b82

SHA-1 Hash

20214e2e93b1bb37108aa1b8666f6406fabca8a0 3b4366d5a1d7a59fa6600ace9f666767b00871d6 73a3a34d64f199a2f94545e1827d43e2e87f0dac 85ce988064d5ac2a927f2ee46e5243e3ef5dabb5 8abe82f6a083288baafac75227ca9ef54d405495 aa4556b843d250a54d06bc3b2cc36a52ea645b35 cd70d69ed034eca924227a89391237342d6dcbdb ce912458662aa0f5859c679be137fd5b836887ae +6 more

SHA-256 Hash

666a4c569d435d0e6bf9fa4d337d1bf014952b42cc6d20e797db6c9df92dd724 f4e72145e761bcc8226353bb121eb8e549dc0000c6535bfa627795351037dc8e

IPv4 Address

103.27.109.217

URL

http://:52202`

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

16 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (3)

M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Installation (7)

M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +2 more

Actions on Objectives (2)

M1031 Network Intrusion Prevention M1057 Data Loss Prevention

Detection Coverage

4 strategies

4/7 stages covered

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0287 Exploitation for Client Execution – cros...

Installation (1)

DET0363 Detection of Credential Dumping from LSA...

Actions on Objectives (1)

DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

BrazenBamboo

Type: Unknown Active

Infrastructure 15 IOC(s)

50%

Domain

TMP.Lapis readme.txt Hunt.io mod.dat ADORE.XSEC +8

IPv4 Address

103.27.109.217

URL

http://:52202`

Artifacts (25)

localupload.exe ffmpeg.dll data.dll frame.dll vertdll.dll msenvico.dll +19

Capability

50%

4 technique(s) 51 tool(s)/malware 1 CVE(s)

AMOS BLACKCOFFEE Backdoors BeaverTail C2 infrastructure CALENDAR CROSSWALK Camaro Dragon +43

credential access

T1003.001

execution

T1203

exfiltration

T1041

initial access

T1190

Victim

70%

Targeted Sectors

financial-services government education defense healthcare pharmaceutical telecommunications transportation retail energy oil-gas manufacturing maritime hospitality media construction gaming

Targeted Countries

CN US KP KR TW IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

AMOS BLACKCOFFEE Backdoors

Infrastructure

TMP.Lapis readme.txt Hunt.io

4 Exploitation

Capability (Techniques)

T1203

Capability (Malware)

AMOS BLACKCOFFEE Backdoors

Infrastructure

TMP.Lapis readme.txt Hunt.io

5 Installation

Capability (Techniques)

T1003.001

Capability (Malware)

AMOS BLACKCOFFEE Backdoors

Infrastructure

TMP.Lapis readme.txt Hunt.io

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

AMOS BLACKCOFFEE Backdoors

Infrastructure

TMP.Lapis readme.txt Hunt.io