Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UNC6032 (threat actor)

Risk

Critical

13 techniques 50 tools/malware 40 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1059.006

Python execution

T1204

User Execution execution

CVE CVE-2017-9841

CVE CVE-2018-0171

CVE CVE-2018-1160

CVE CVE-2018-15133

CVE CVE-2018-20062

CVE CVE-2019-10744

CVE CVE-2019-18394

CVE CVE-2019-9082

CVE CVE-2020-12641

CVE CVE-2020-24363

CVE CVE-2020-35730

CVE CVE-2021-3129

CVE CVE-2021-44026

CVE CVE-2021-44228

CVE CVE-2022-26376

CVE CVE-2022-31199

CVE CVE-2022-36327

CVE CVE-2022-42475

CVE CVE-2022-44877

CVE CVE-2022-47986

CVE CVE-2023-0669

CVE CVE-2023-20593

CVE CVE-2023-20864

CVE CVE-2023-20865

CVE CVE-2023-20887

CVE CVE-2023-20888

CVE CVE-2023-20889

CVE CVE-2023-22515

CVE CVE-2023-26369

CVE CVE-2023-26370

CVE CVE-2023-27532

CVE CVE-2023-27997

CVE CVE-2023-2834

CVE CVE-2023-29363

CVE CVE-2023-2986

CVE CVE-2023-32014

CVE CVE-2023-32015

CVE CVE-2023-32434

CVE CVE-2023-32435

CVE CVE-2023-33042

›

5 Installation

T1082

System Information Discovery discovery

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

T1119

Automated Collection collection

T1001

Data Obfuscation command and control

T1090.003

Multi-hop Proxy command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1055

Process Injection stealth

T1363

Stage risk: Critical High Medium None

Tools & Malware (50)

BANSHEE Backdoors C:\winsystem\heif\heif.exe launcher CALENDAR Cobalt Codex Conti Cursor Epic Exodus Explorer FROSTRIFT .NET backdoor GRIMPULL downloader GitHub Global HAVEX RAT Havex RAT Hyper-V Information-stealing malware Infostealer Kevin Langflow Leverage Malware Payloads Microsoft Teams Nexus PLAY Payload Payload Phishing emails Phoenix PlugX PowerShell Python loader STARKVEIL dropper STOP SUNBURST Shai-Hulud TOUGHPROGRESS Telegram Trojan Void WhatsApp XWORM .NET backdoor XWorm YARA ZLib Zeus avcodec-61.dll side‑loaded DLL phishing

Indicators of Compromise (39)

Domain

strokes.zapto.org demo-cloud.space canvadream-lab.com lumaai-labs.com klingxai.com artisanaqua.ddnsking.com Log.tmp

Filename

avcodec-61.dll Launcher.exe pythonw.exe ffplay.exe py.exe 626.zip heif-info.exe USB.exe +13 more

SHA-256 Hash

a0e75bd0b0fa0174566029d0e50875534c2fcc5ba982bd539bdeff506cae32d3 8d2c9c2b5af31e0e74185a82a816d3d019a0470a7ad8f5c1b40611aa1fd275cc 4982a33e0c2858980126b8279191cb4eddd0a35f936cf3eda079526ba7c76959 dcb1e9c6b066c2169928ae64e82343a250261f198eb5d091fd7928b69ed135d3 e663c1ba289d890a74e33c7e99f872c9a7b63e385a6a4af10a856d5226c9a822 839260ac321a44da55d4e6a5130c12869066af712f71c558bd42edd56074265b 1a037da4103e38ff95cb0008a5e38fd6a8e7df5bc8e2d44e496b7a5909ddebeb

URL

http://klingxai.com http://lumalabsai.in/complete/ http://lumalabsai.in/ http://lumalabsai.in/complete

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

18 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more

Exploitation (8)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention +3 more

Command & Control (4)

M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information

Actions on Objectives (4)

M1026 Privileged Account Management M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1057 Data Loss Prevention

Detection Coverage

12 strategies

5/7 stages covered

Delivery (2)

DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0063 Cross-Platform Behavioral Detection of P... DET0478 User Execution – multi-surface behavior...

Installation (2)

DET0365 Detect Registry and Startup Folder Persi... DET0525 System Discovery via Native and Remote U...

Command & Control (4)

DET0053 Detect Obfuscated C2 via Network Traffic... DET0060 Detect Ingress Tool Transfers via Behavi... DET0186 Automated File and API Collection Detect... DET0359 Multi-hop Proxy Behavior via Relay Node...

Actions on Objectives (2)

DET0348 Detection Strategy for Exfiltration Over... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UNC6032

Type: Unknown Active

tracked as UNC6032 by Mandiant STARKVEIL

Infrastructure 11 IOC(s)

50%

Domain

strokes.zapto.org demo-cloud.space canvadream-lab.com lumaai-labs.com klingxai.com +2

URL

http://klingxai.com http://lumalabsai.in/complete/ http://lumalabsai.in/ http://lumalabsai.in/complete

Artifacts (28)

avcodec-61.dll Launcher.exe pythonw.exe ffplay.exe py.exe 626.zip +22

Capability

50%

13 technique(s) 50 tool(s)/malware 40 CVE(s)

BANSHEE Backdoors C:\winsystem\heif\heif.exe launcher CALENDAR Cobalt Codex Conti Cursor +42

T1363

collection

T1119

command and control

T1001 T1090.003 T1105

discovery

T1082

Victim

70%

Targeted Sectors

defense media manufacturing government utilities telecommunications non-profit financial-services healthcare information-technology education transportation

Targeted Countries

VN US AU RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001

Capability (Malware)

BANSHEE Backdoors C:\winsystem\heif\heif.exe launcher

Infrastructure

strokes.zapto.org demo-cloud.space canvadream-lab.com

4 Exploitation

Capability (Techniques)

T1059.006 T1204

Capability (Malware)

BANSHEE Backdoors C:\winsystem\heif\heif.exe launcher

Infrastructure

strokes.zapto.org demo-cloud.space canvadream-lab.com

5 Installation

Capability (Techniques)

T1082 T1547.001

Capability (Malware)

BANSHEE Backdoors C:\winsystem\heif\heif.exe launcher

Infrastructure

strokes.zapto.org demo-cloud.space canvadream-lab.com

6 Command & Control

Capability (Techniques)

T1119 T1001 T1090.003 T1105

Capability (Malware)

BANSHEE Backdoors C:\winsystem\heif\heif.exe launcher

Infrastructure

strokes.zapto.org demo-cloud.space canvadream-lab.com

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

BANSHEE Backdoors C:\winsystem\heif\heif.exe launcher

Infrastructure

strokes.zapto.org demo-cloud.space canvadream-lab.com