Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Earth Kurma (threat actor)

Risk

High

13 techniques 51 tools/malware 0 vulnerabilities 59 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1059.001

PowerShell execution

›

5 Installation

T1110

Brute Force credential access

T1552

Unsecured Credentials credential access

T1046

Network Service Discovery discovery

›

6 Command & Control

T1056.001

Keylogging collection

T1071.001

Web Protocols command and control

T1071.004

DNS command and control

T1021.002

SMB/Windows Admin Shares lateral movement

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1014

Rootkit stealth

T1036

Masquerading stealth

T1055

Process Injection stealth

T1070.004

File Deletion stealth

Stage risk: Critical High Medium None

Tools & Malware (51)

BPFDoor Backdoors ClickFix Cobalt Cobalt Strike Custom malware DMLOADER DUNLOADER Dark Explorer FRPC Ghost RAT Global Hook ICMPinger Interception Jackal KMLOG KRNRAT Karma LADON Ladon LockBit Luna MORIYA Malicious APK Mobile malware Moriya NBTSCAN Nefilim Nexus PLAY Payload Payload PowerShell Rootkit Rundll32 SIMPOBOXSPY SMB protocol SManager ShadowPad TESDAT Trojan Unknown Void WMIHACKER Wicked Winrar phishing rundll32.exe syssetup.dll

Indicators of Compromise (59)

Domain

syssetup.dll gpupdat.exe classes.dex classes2.dex svchost.exe cmd.exe powershell.exe rundll32.exe +28 more

Filename

mfsvc.dll cmd.exe rundll32.exe vdmsc.dll dilx.exe svchost.exe i111111.zip sc.exe +10 more

SHA-256 Hash

5b9bd063360912a57a1cde5c1980594703ab301161c9a91197bff76352410df0 c4a4c485660abe8286c58d2f6c8bb7e2e698db305761e703987efc6653c2ec25 1963b78a98c24e106ba93168f69ad12914e339a155b797a4d6fb6e8ff88819ea 3ddefbacd77de58c226a388ad92125e1333a7211fc0b1d636dea778923190c4f

IPv4 Address

38.47.53.168

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (5)

M1026 Privileged Account Management M1038 Execution Prevention M1042 Disable or Remove Feature or Program M1045 Code Signing M1049 Antivirus/Antimalware

Installation (17)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +12 more

Command & Control (5)

M1026 Privileged Account Management M1027 Password Policies M1031 Network Intrusion Prevention M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic

Actions on Objectives (11)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1031 Network Intrusion Prevention +6 more

Detection Coverage

13 strategies

4/7 stages covered

Exploitation (1)

DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (3)

DET0376 Behavioral Detection Strategy for Networ... DET0412 Detect Access or Search for Unsecured Cr... DET0463 Brute Force Authentication Failures with...

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0089 Behavioral Detection of Keylogging Activ... DET0400 Behavioral Detection of DNS Tunneling an... DET0530 Multi-Event Detection for SMB Admin Shar...

Actions on Objectives (5)

DET0127 Behavioral Detection of Masquerading Acr... DET0140 Behavioral Detection of Malicious File D... DET0348 Detection Strategy for Exfiltration Over... DET0377 Detection of Kernel/User-Level Rootkit B... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Earth Kurma

Type: Unknown Active

tracked as Parashuram is a revered TASPEN civil servants

Infrastructure 37 IOC(s)

50%

Domain

syssetup.dll gpupdat.exe classes.dex classes2.dex svchost.exe +31

IPv4 Address

38.47.53.168

Artifacts (22)

mfsvc.dll cmd.exe rundll32.exe vdmsc.dll dilx.exe svchost.exe +16

Capability

50%

13 technique(s) 51 tool(s)/malware

BPFDoor Backdoors ClickFix Cobalt Cobalt Strike Custom malware DMLOADER DUNLOADER +43

collection

T1056.001

command and control

T1071.001 T1071.004

credential access

T1110 T1552

discovery

T1046

Victim

70%

Targeted Sectors

government telecommunications financial-services media defense energy critical-infrastructure utilities

Targeted Countries

VN SG US CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1059.001

Capability (Malware)

BPFDoor Backdoors ClickFix

Infrastructure

syssetup.dll gpupdat.exe classes.dex

5 Installation

Capability (Techniques)

T1110 T1552 T1046

Capability (Malware)

BPFDoor Backdoors ClickFix

Infrastructure

syssetup.dll gpupdat.exe classes.dex

6 Command & Control

Capability (Techniques)

T1056.001 T1071.001 T1071.004 T1021.002

Capability (Malware)

BPFDoor Backdoors ClickFix

Infrastructure

syssetup.dll gpupdat.exe classes.dex

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

BPFDoor Backdoors ClickFix

Infrastructure

syssetup.dll gpupdat.exe classes.dex