Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Luna Moth (threat actor)
Risk
82
Critical
42 techniques 51 tools/malware 2 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
5
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
T1566.003
Spearphishing via Service initial access
T1566.004
Spearphishing Voice initial access
›
4 Exploitation
8
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1072
Software Deployment Tools execution
T1204
User Execution execution
T1204.002
Malicious File execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2022-41040
CVE CVE-2022-41082
›
5 Installation
12
T1003.001
LSASS Memory credential access
T1003.008
/etc/passwd and /etc/shadow credential access
T1555.003
Credentials from Web Browsers credential access
T1606.002
SAML Tokens credential access
T1046
Network Service Discovery discovery
T1083
File and Directory Discovery discovery
T1087.001
Local Account discovery
T1135
Network Share Discovery discovery
T1098
Account Manipulation persistence
T1133
External Remote Services persistence
T1136.001
Local Account persistence
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
7
T1560.001
Archive via Utility collection
T1090.003
Multi-hop Proxy command and control
T1105
Ingress Tool Transfer command and control
T1219
Remote Access Tools command and control
T1021.001
Remote Desktop Protocol lateral movement
T1021.004
SSH lateral movement
T1550.002
Pass the Hash lateral movement
›
7 Actions on Objectives
12
T1112
Modify Registry defense impairment
T1222.002
Linux and Mac Permissions defense impairment
T1567.002
Exfiltration to Cloud Storage exfiltration
T1486
Data Encrypted for Impact impact
T1027
Obfuscated Files or Information stealth
T1070.003
Clear Command History stealth
T1070.004
File Deletion stealth
T1078
Valid Accounts stealth
T1197
BITS Jobs stealth
T1218.011
Rundll32 stealth
T1070.001
T1070.001
T1562.004
T1562.004
Stage risk: Critical High Medium None

Tools & Malware (51)

AnyDesk AppleJeus BASTA ransomware Black Basta Black Basta ransomware Black Basta ransomware Conti Conti ransomware Curator Dark Global Handala Hikit INC Ransomware INC Ransomware Kimsuky LaZagne Lumma Stealer Lumma Stealer Luna Mimikatz MuddyWater Netscan Nexus Payload Payload Phishing campaigns Phishing emails PowerShell PuTTY Quick Assist Quick Assist REvil REvil ransomware REvil ransomware ROMCOM RAT ROMCOM RAT Rclone Royal Royal Ransomware Royal Ransomware Rundll32 Ryuk Ryuk ransomware Splinter Stealc Void WildFire Windows Command Shell curl phishing

Indicators of Compromise (39)

Domain
privnote.com it.com helpdesk.com Justicehomeland.org karmabelow80.org handala-hack.to handala-redwatned.to HHS.gov +9 more
Email Address
support@microsoftonlines.com
Filename
cmd.exe runonce.exe 7z.exe tor.exe netscan.exe Windows365.exe rundll32.exe ssh.exe +1 more
SHA-256 Hash
BF93B029CCA0DE4B6F32E98AEEBD8FD690964816978A0EB13A085A80D4B6BF4E 2411a74b343bbe51b2243985d5edaaabe2ba70e0c923305353037d1f442a91f5 9935DA29F3E4E503E4A4712379CCD9963A730CCC304C2FEC31E8276DB35E82E8 55e4d509de5b0f1ea888ff87eb0d190c328a559d7cc5653c46947e57c0f01ec5 6a2bd52a5d68a7250d1de481dcce91a32f54824c1c540f0a040d05f757220cd3
IPv4 Address
192.236.147.138 185.239.222.240 108.62.103.193 185.143.223.13 185.253.163.23 192.236.147.131 185.129.62.62

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

35 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (20)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content +15 more
Installation (18)
M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +13 more
Command & Control (14)
M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention +9 more
Actions on Objectives (20)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +15 more

Detection Coverage

40 strategies
5/7 stages covered

Delivery (5)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0115 Detection Strategy for Spearphishing via... DET0236 Detection Strategy for Spearphishing Att... DET0245 Detection Strategy for Spearphishing Voi...

Exploitation (6)

DET0202 Behavioral Detection of Windows Command... DET0223 Detection of Adversary Abuse of Software... DET0294 User Execution – Malicious File via down... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... +1 more

Installation (12)

DET0037 Detect Suspicious Access to Browser Cred... DET0096 Account Manipulation Behavior Chain Dete... DET0148 Detection Strategy for Forged SAML Token... DET0182 Behavior-chain detection for T1135 Netwo... DET0303 Local Account Enumeration Across Host Pl... +7 more

Command & Control (7)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0298 Detect Archiving via Utility (T1560.001) DET0327 Multi-event Detection Strategy for RDP-B... DET0359 Multi-hop Proxy Behavior via Relay Node... DET0409 Detection Strategy for T1550.002 - Pass... +2 more

Actions on Objectives (10)

DET0098 Detect abuse of Windows BITS Jobs for do... DET0140 Behavioral Detection of Malicious File D... DET0165 Behavioral Detection of Command History... DET0215 Detection of Multi-Platform File Encrypt... DET0280 Behavior-Based Registry Modification Det... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Luna Moth

Type: Unknown Active
Silent Ransom TG2729 Chatty Spider UNC3753 is +7 more
Infrastructure 24 IOC(s)
50%
Domain
privnote.com it.com helpdesk.com Justicehomeland.org karmabelow80.org +12
IPv4 Address
192.236.147.138 185.239.222.240 108.62.103.193 185.143.223.13 185.253.163.23 +2
Artifacts (15)
support@microsoftonlines.com cmd.exe runonce.exe 7z.exe tor.exe netscan.exe +9
Capability
50%
42 technique(s) 51 tool(s)/malware 2 CVE(s)
AnyDesk AppleJeus BASTA ransomware Black Basta Black Basta ransomware Black Basta ransomware Conti Conti ransomware +43
T1070.001 T1562.004
collection
T1560.001
command and control
T1090.003 T1105 T1219
credential access
T1003.001 T1003.008 T1555.003 T1606.002
Victim
70%

Targeted Sectors

legal-services financial-services information-technology healthcare utilities government defense energy education manufacturing critical-infrastructure

Targeted Countries

US CN GB UA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Malware)

AnyDesk AppleJeus BASTA ransomware
4 Exploitation

Capability (Malware)

AnyDesk AppleJeus BASTA ransomware
5 Installation

Capability (Malware)

AnyDesk AppleJeus BASTA ransomware
6 Command & Control

Capability (Malware)

AnyDesk AppleJeus BASTA ransomware
7 Actions on Objectives

Capability (Techniques)

T1567.002 T1486

Capability (Malware)

AnyDesk AppleJeus BASTA ransomware
Leaving Threaticon

This link opens an external site that isn't part of the platform.