Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

PlushDaemon (threat actor)

Risk

Critical

40 techniques 62 tools/malware 13 vulnerabilities 54 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.001

Domains resource development

T1583.004

Server resource development

T1588.001

Malware resource development

T1588.002

Tool resource development

T1588.003

Code Signing Certificates resource development

T1588.005

Exploits resource development

T1608.001

Upload Malware resource development

T1608.002

Upload Tool resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1195.002

Compromise Software Supply Chain initial access

T1659

Content Injection initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.003

Windows Command Shell execution

T1059.006

Python execution

CVE CVE-2017-0199

CVE CVE-2017-11882

CVE CVE-2018-6065

CVE CVE-2021-26084

CVE CVE-2021-31207

CVE CVE-2021-34473

CVE CVE-2021-34523

CVE CVE-2022-26318

CVE CVE-2023-22518

CVE CVE-2023-27532

CVE CVE-2024-3721

CVE CVE-2024-40711

CVE CVE-2024-40766

›

5 Installation

T1012

Query Registry discovery

T1016

System Network Configuration Discovery discovery

T1016.002

Wi-Fi Discovery discovery

T1033

System Owner/User Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1120

Peripheral Device Discovery discovery

T1217

Browser Information Discovery discovery

T1518

Software Discovery discovery

T1614

System Location Discovery discovery

T1547.001

Registry Run Keys / Startup Folder persistence

T1547.004

Winlogon Helper DLL persistence

›

6 Command & Control

T1005

Data from Local System collection

T1074.001

Local Data Staging collection

T1123

Audio Capture collection

T1560.002

Archive via Library collection

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1222.001

Windows Permissions defense impairment

T1553.002

Code Signing defense impairment

T1027.007

Dynamic API Resolution stealth

T1027.009

Embedded Payloads stealth

T1027.013

Encrypted/Encoded File stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1070.004

File Deletion stealth

T1574.002

Stage risk: Critical High Medium None

Tools & Malware (62)

ATI-Agent AdobeARM Agent.btz Agent.dne Akira BADAUDIO Backdoors BioSet Cobalt Cobalt Strike Crisis Custom Backdoor Custom backdoors Custom malware DaemonicLogistics Dark EdgeStepper GalaxyGato Gazer GitHub Global GoRed Jackal Legitimate Software LittleDaemon Malicious files Mimikatz MiniDionis MuddyWater Nautilus Net Neuron OilRig Payload Payload PhantomVAI Phishing emails PowerShell Red Likho Ruler Sharp7Extend SlowStepper SlowStepper backdoor SocGholish Spear-phishing Systeminfo Tasklist Tavdig Telegram Turla UNC1549 Unknown Uroburos Void WhiteBear Winnti Wipbot gpresult lregdll.dll phishing pwdump wce

Indicators of Compromise (54)

Domain

stoll.mod README.adoc BootstrapCache.pkg cmd.exe svcghost.exe lregdll.dll PerfWatson.exe AutoMsg.dll +29 more

Email Address

threatintel@eset.com

Filename

svcghost.exe lregdll.dll assist.dll ShellcodeRunner.GZ PerfWatson.exe AutoMsg.dll regcap.exe MMpLics.dll +6 more

IPv4 Address

47.242.198.250 114.114.114.114

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (10)

M1016 Vulnerability Scanning M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network +5 more

Exploitation (9)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +4 more

Installation (2)

M1018 User Account Management M1038 Execution Prevention

Command & Control (1)

M1057 Data Loss Prevention

Actions on Objectives (7)

M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +2 more

Detection Coverage

39 strategies

6/7 stages covered

Weaponization (8)

DET0824 Detection of Upload Malware DET0827 Detection of Exploits DET0834 Detection of Upload Tool DET0845 Detection of Malware DET0852 Detection of Tool +3 more

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0309 Compromised software/update chain (insta... DET0349 Detection Strategy for Content Injection

Exploitation (3)

DET0063 Cross-Platform Behavioral Detection of P... DET0202 Behavioral Detection of Windows Command... DET0516 Behavioral Detection of Command and Scri...

Installation (13)

DET0013 Detection of Local Browser Artifact Acce... DET0034 Detection of Adversarial Process Discove... DET0043 Detection Strategy for System Location D... DET0093 Behavioral Detection of User Discovery v... DET0195 Behavioral Detection of System Network C... +8 more

Command & Control (4)

DET0221 Behavioral Detection Strategy for T1123... DET0261 Detection of Local Data Staging Prior to... DET0268 Detect Archiving via Library (T1560.002) DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (8)

DET0087 Encrypted or Encoded File Payload Detect... DET0091 Detection Strategy for Dynamic API Resol... DET0140 Behavioral Detection of Malicious File D... DET0214 Detection Strategy for Embedded Payloads DET0230 Detect Suspicious or Malicious Code Sign... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

PlushDaemon

Type: Unknown Active

Storm-0978 Tropical Scorpius APT34 Smoke Sandstorm TA455 +94 more

Infrastructure 39 IOC(s)

50%

Domain

stoll.mod README.adoc BootstrapCache.pkg cmd.exe svcghost.exe +32

IPv4 Address

47.242.198.250 114.114.114.114

Artifacts (15)

threatintel@eset.com svcghost.exe lregdll.dll assist.dll ShellcodeRunner.GZ PerfWatson.exe +9

Capability

56%

40 technique(s) 62 tool(s)/malware 13 CVE(s)

ATI-Agent AdobeARM Agent.btz Agent.dne Akira BADAUDIO Backdoors BioSet +54

T1574.002

collection

T1005 T1074.001 T1123 T1560.002

defense impairment

T1112 T1222.001 T1553.002

discovery

T1012 T1016 T1016.002 T1033 +7

Victim

70%

Targeted Sectors

government defense financial-services telecommunications manufacturing energy education transportation non-profit critical-infrastructure aerospace healthcare think-tank media maritime pharmaceutical food-agriculture aviation chemical utilities construction entertainment legal-services retail nuclear hospitality oil-gas information-technology

Targeted Countries

CN RU US UA KR IL TW AE BY IR IN PK JP VN PL LB TR DE KZ FR EG KP IQ IT SA CA GB BR MX

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.001 T1583.004 T1588.001 T1588.002 T1588.003

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

stoll.mod README.adoc BootstrapCache.pkg

3 Delivery

Capability (Techniques)

T1190 T1195.002 T1659

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

stoll.mod README.adoc BootstrapCache.pkg

4 Exploitation

Capability (Techniques)

T1059 T1059.003 T1059.006

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

stoll.mod README.adoc BootstrapCache.pkg

5 Installation

Capability (Techniques)

T1012 T1016 T1016.002 T1033 T1057

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

stoll.mod README.adoc BootstrapCache.pkg

6 Command & Control

Capability (Techniques)

T1005 T1074.001 T1123 T1560.002

Capability (Malware)

ATI-Agent AdobeARM Agent.btz

Infrastructure

stoll.mod README.adoc BootstrapCache.pkg