Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

UAT-7237 (threat actor)

Risk

High

8 techniques 47 tools/malware 0 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1068

Exploitation for Privilege Escalation privilege escalation

›

5 Installation

T1003

OS Credential Dumping credential access

T1018

Remote System Discovery discovery

›

6 Command & Control

T1071.001

Web Protocols command and control

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1574.014

AppDomainManager stealth

Stage risk: Critical High Medium None

Tools & Malware (47)

AppDomainManager BITS Cobalt Cobalt Strike Custom Backdoor Custom malware Fscan GitHub Group Policy Hook IcedID Interception JuicyPotato MSBuild Mimikatz Nexus Open-source tools Payload Payload PerfWatson2.exe PowerShell Process Hollowing Qilin Qilin Ransomware RAR archives STOP SharpWMI SoftEther VPN SoftEther VPN Client SoundBill TinyRCT Trojan UAT-8302 Unknown VNT WMICmd Web Shell Web Shells WhatsApp WildFire XCSSET curl netsh npm packages phishing systemd whoami

Indicators of Compromise (40)

Domain

System.Net.WebClient Mallory.ai 5fbridge.config cisa.gov cvbbonwxtgvc3isfqfc52cwzja0kvuqd.lambda-url.ap-northeast-1.on.aws 1.txt exe.config

Filename

choice.exe Project1.exe MyAppDomainManager.dll 1.zip win-x64.rar VTSB.exe juicy2.exe Fileless.exe +13 more

SHA-256 Hash

9b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472 00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87b cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3 4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d8384

IPv4 Address

45.32.113.172 202.182.102.5 45.76.210.43 8.8.8.8 141.164.50.141 139.180.134.221

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Exploitation (8)

M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Installation (9)

M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +4 more

Command & Control (5)

M1018 User Account Management M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic M1042 Disable or Remove Feature or Program

Actions on Objectives (2)

M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions

Detection Coverage

8 strategies

4/7 stages covered

Exploitation (2)

DET0364 Behavioral Detection Strategy for WMI Ex... DET0514 Detection Strategy for Exploitation for...

Installation (2)

DET0234 Credential Dumping via Sensitive Memory... DET0574 Detection Strategy for Remote System Enu...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (2)

DET0280 Behavior-Based Registry Modification Det... DET0517 Detection Strategy for Hijack Execution...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

UAT-7237

Type: Unknown Active

CL-STA-1062 deployed against government entities tracked as Flax Flax Typhoon +1 more

Infrastructure 13 IOC(s)

50%

Domain

System.Net.WebClient Mallory.ai 5fbridge.config cisa.gov cvbbonwxtgvc3isfqfc52cwzja0kvuqd.lambda-url.ap-northeast-1.on.aws +2

IPv4 Address

45.32.113.172 202.182.102.5 45.76.210.43 8.8.8.8 141.164.50.141 +1

Artifacts (27)

choice.exe Project1.exe MyAppDomainManager.dll 1.zip win-x64.rar VTSB.exe +21

Capability

50%

8 technique(s) 47 tool(s)/malware

AppDomainManager BITS Cobalt Cobalt Strike Custom Backdoor Custom malware Fscan GitHub +39

command and control

T1071.001

credential access

T1003

defense impairment

T1112

discovery

T1018

Victim

70%

Targeted Sectors

government critical-infrastructure energy telecommunications utilities education healthcare defense

Targeted Countries

TW CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1047 T1068

Capability (Malware)

AppDomainManager BITS Cobalt

Infrastructure

System.Net.WebClient Mallory.ai 5fbridge.config

5 Installation

Capability (Techniques)

T1003 T1018

Capability (Malware)

AppDomainManager BITS Cobalt

Infrastructure

System.Net.WebClient Mallory.ai 5fbridge.config

6 Command & Control

Capability (Techniques)

T1071.001 T1021.004

Capability (Malware)

AppDomainManager BITS Cobalt

Infrastructure

System.Net.WebClient Mallory.ai 5fbridge.config