Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Educated Manticore (threat actor)

Risk

Medium

1 techniques 41 tools/malware 0 vulnerabilities 39 IOCs 1/7 stages covered Deepest: Installation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

T1547.004

Winlogon Helper DLL persistence

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (41)

Ababil AdWind BASICSTAR Backdoors Cobalt DragonBreath Epic Expand Explorer Explosive Global Guard Handala LNK files Leverage Mirage MuddyWater Nemesis NirCmd POWERSTAR Payload Payload Phishing Kit Phishing campaigns Phishing kits PowerLess PowerShell PowerShell backdoor PupyRAT Spear-phishing Spear-phishing Campaigns Specter Telegram Trojan WannaCry Warp WhatsApp Winrar curl phishing route

Indicators of Compromise (39)

Domain

deersharpfork.info idautils.Heads BBsJunk.append a.which rasanah-iiis.org rasaaneh-iiis.org rasaanah-iiis.org subinfralab.info +7 more

Filename

tmp1940166302.exe Iraq-project.rar blacksmith.exe AudioRecorder4.exe update.vbs a.vbs resources.exe so.zip +15 more

MD5 Hash

1D1FB0BB21B94FC0B017A4DADA231E17

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

2 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Installation (2)

M1018 User Account Management M1038 Execution Prevention

Detection Coverage

1 strategies

1/7 stages covered

Installation (1)

DET0404 Detect Winlogon Helper DLL Abuse via Reg...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Educated Manticore

Type: Unknown Active

Charming Kitten APT42 Mint Sandstorm Magic Hound APT35 +25 more

Infrastructure 15 IOC(s)

50%

Domain

deersharpfork.info idautils.Heads BBsJunk.append a.which rasanah-iiis.org +10

Artifacts (24)

tmp1940166302.exe Iraq-project.rar blacksmith.exe AudioRecorder4.exe update.vbs a.vbs +18

Capability

50%

1 technique(s) 41 tool(s)/malware

Ababil AdWind BASICSTAR Backdoors Cobalt DragonBreath Epic Expand +33

persistence

T1547.004

Victim

70%

Targeted Sectors

education defense media non-profit government energy critical-infrastructure maritime healthcare manufacturing transportation telecommunications aviation aerospace information-technology oil-gas financial-services think-tank food-agriculture

Targeted Countries

IR US IL RU IQ SA UA AE CN KP TR DE

Diamond Model Meta-Features

Phase

Installation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

5 Installation

Capability (Techniques)

T1547.004

Capability (Malware)

Ababil AdWind BASICSTAR

Infrastructure

deersharpfork.info idautils.Heads BBsJunk.append