Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
PurpleHaze (threat actor)
Risk
100
Critical
53 techniques 68 tools/malware 13 vulnerabilities 39 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
1
T1595
Active Scanning reconnaissance
›
2 Weaponization
4
T1583
Acquire Infrastructure resource development
T1584
Compromise Infrastructure resource development
T1586
Compromise Accounts resource development
T1650
Acquire Access resource development
›
3 Delivery
3
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
T1659
Content Injection initial access
›
4 Exploitation
22
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.007
JavaScript execution
T1609
Container Administration Command execution
T1651
Cloud Administration Command execution
T1068
Exploitation for Privilege Escalation privilege escalation
T1548
Abuse Elevation Control Mechanism privilege escalation
CVE CVE-2012-0158
CVE CVE-2017-11882
CVE CVE-2023-38950
CVE CVE-2023-38951
CVE CVE-2023-38952
CVE CVE-2023-46747
CVE CVE-2024-11182
CVE CVE-2024-1709
CVE CVE-2024-8190
CVE CVE-2024-8963
CVE CVE-2025-33053
CVE CVE-2025-44277
CVE CVE-2025-44288
›
5 Installation
19
T1003
OS Credential Dumping credential access
T1110
Brute Force credential access
T1555
Credentials from Password Stores credential access
T1557
Adversary-in-the-Middle credential access
T1010
Application Window Discovery discovery
T1087
Account Discovery discovery
T1217
Browser Information Discovery discovery
T1526
Cloud Service Discovery discovery
T1538
Cloud Service Dashboard discovery
T1580
Cloud Infrastructure Discovery discovery
T1613
Container and Resource Discovery discovery
T1619
Cloud Storage Object Discovery discovery
T1037
Boot or Logon Initialization Scripts persistence
T1098
Account Manipulation persistence
T1136
Create Account persistence
T1543
Create or Modify System Process persistence
T1547
Boot or Logon Autostart Execution persistence
T1554
Compromise Host Software Binary persistence
T1671
Cloud Application Integration persistence
›
6 Command & Control
7
T1115
Clipboard Data collection
T1119
Automated Collection collection
T1123
Audio Capture collection
T1185
Browser Session Hijacking collection
T1560
Archive Collected Data collection
T1071
Application Layer Protocol command and control
T1092
Communication Through Removable Media command and control
›
7 Actions on Objectives
10
T1020
Automated Exfiltration exfiltration
T1041
Exfiltration Over C2 Channel exfiltration
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1531
Account Access Removal impact
T1055
Process Injection stealth
T1078
Valid Accounts stealth
T1134
Access Token Manipulation stealth
T1197
BITS Jobs stealth
T1612
Build Image on Host stealth
Stage risk: Critical High Medium None

Tools & Malware (68)

Anubis AppDomainManager AppSov.exe Auto-Color Linux backdoor BITS Babuk Backdoors BrockenDoor ClickFix Cobalt Cobalt Strike DarkGate Elise FRP GOREVERSE GOREshell GitHub Global Group Policy HXLibrary HanifNet Havoc Hook Horus Agent Interception KrustyLoader Leverage MSBuild MeshCentral Agent Mimikatz MuddyWater Mythic NeoExpressRAT Nexus Ngrok Nimbo-C2 PDQ PathWiper Payload Payload PhantomCore Phishing emails PowerShell Process Hollowing Remcos Remote access tools Reverse_SSH ScatterBrain SentinelOne ShadowPad Spear-phishing Spear-phishing emails SpearPress_HORDE SpearPress_MDAEMON SpearPress_ROUNDCUBE SpearPress_ZIMBRA Syncro SystemBC Telegram Unknown Void Web Shells Windows Command Shell inter netsh phishing plink systemd

Indicators of Compromise (39)

Domain
BI.ZONE rss.php downloads.trendav.vip tatacom.duckdns.org news.imaginerjp.com dscriy.chtq.net network.oossafe.com notes.oossafe.com +10 more
Filename
AppSov.EXE svchost.exe explorer.exe spoolsv.exe user32.dll mpnotify.exe AppSov.exe glib-2.0.dll +5 more
IPv4 Address
65.38.120.110 143.244.137.54 103.248.61.36 45.13.199.209 142.93.212.42 142.93.214.219 107.173.111.26 128.199.124.136

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

37 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (16)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +11 more
Exploitation (18)
M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +13 more
Installation (24)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +19 more
Command & Control (9)
M1017 User Training M1018 User Account Management M1028 Operating System Configuration M1029 Remote Data Storage M1031 Network Intrusion Prevention +4 more
Actions on Objectives (17)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +12 more

Detection Coverage

53 strategies
7/7 stages covered

Reconnaissance (1)

DET0830 Detection of Active Scanning

Weaponization (4)

DET0876 Detection of Compromise Accounts DET0884 Detection of Acquire Access DET0885 Detection of Compromise Infrastructure DET0895 Detection of Acquire Infrastructure

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att... DET0349 Detection Strategy for Content Injection

Exploitation (9)

DET0065 Detection Strategy for Container Adminis... DET0264 Cross-Platform Detection of JavaScript E... DET0345 Detection Strategy for Abuse Elevation C... DET0364 Behavioral Detection Strategy for WMI Ex... DET0441 Detection of Suspicious Scheduled Task C... +4 more

Installation (19)

DET0013 Detection of Local Browser Artifact Acce... DET0096 Account Manipulation Behavior Chain Dete... DET0097 Detection of Application Window Enumerat... DET0112 Boot or Logon Initialization Scripts Det... DET0169 Detection Strategy for Cloud Infrastruct... +14 more

Command & Control (7)

DET0090 Cross-host C2 via Removable Media Relay DET0186 Automated File and API Collection Detect... DET0221 Behavioral Detection Strategy for T1123... DET0341 Clipboard Data Access with Anomalous Con... DET0444 Detection of Command and Control Over Ap... +2 more

Actions on Objectives (10)

DET0098 Detect abuse of Windows BITS Jobs for do... DET0120 Account Access Removal via Multi-Platfor... DET0146 Detection of Data Destruction Across Pla... DET0215 Detection of Multi-Platform File Encrypt... DET0283 Behavior-chain detection for T1134 Acces... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

PurpleHaze

Type: Unknown Active
Nylon Typhoon APT28 Fancy Bear tracked as drug street names +59 more
Infrastructure 26 IOC(s)
50%
Domain
BI.ZONE rss.php downloads.trendav.vip tatacom.duckdns.org news.imaginerjp.com +13
IPv4 Address
65.38.120.110 143.244.137.54 103.248.61.36 45.13.199.209 142.93.212.42 +3
Artifacts (13)
AppSov.EXE svchost.exe explorer.exe spoolsv.exe user32.dll mpnotify.exe +7
Capability
50%
53 technique(s) 68 tool(s)/malware 13 CVE(s)
Anubis AppDomainManager AppSov.exe Auto-Color Linux backdoor BITS Babuk Backdoors BrockenDoor +60
collection
T1115 T1119 T1123 T1185 +1
command and control
T1071 T1092
credential access
T1003 T1110 T1555 T1557
discovery
T1010 T1087 T1217 T1526 +4
Victim
70%

Targeted Sectors

government financial-services defense telecommunications media transportation manufacturing energy information-technology utilities education retail construction healthcare aerospace critical-infrastructure aviation non-profit oil-gas chemical mining nuclear

Targeted Countries

CN RU TW KP US UA IL SY KR SA IN TR AE CA IR GB JP VN BR AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1595

Capability (Malware)

Anubis AppDomainManager AppSov.exe
2 Weaponization

Capability (Techniques)

T1583 T1584 T1586 T1650

Capability (Malware)

Anubis AppDomainManager AppSov.exe
3 Delivery

Capability (Techniques)

T1190 T1566.001 T1659

Capability (Malware)

Anubis AppDomainManager AppSov.exe
4 Exploitation

Capability (Malware)

Anubis AppDomainManager AppSov.exe
5 Installation

Capability (Malware)

Anubis AppDomainManager AppSov.exe
6 Command & Control

Capability (Malware)

Anubis AppDomainManager AppSov.exe
7 Actions on Objectives

Capability (Malware)

Anubis AppDomainManager AppSov.exe
Leaving Threaticon

This link opens an external site that isn't part of the platform.