Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
UAC-0241 (threat actor)
Risk
79
Critical
49 techniques 50 tools/malware 1 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1189
Drive-by Compromise initial access
›
4 Exploitation
14
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.013
Container CLI/API execution
T1129
Shared Modules execution
T1204.002
Malicious File execution
T1204.004
Malicious Copy and Paste execution
T1559
Inter-Process Communication execution
T1559.001
Component Object Model execution
T1559.002
Dynamic Data Exchange execution
T1610
Deploy Container execution
T1548
Abuse Elevation Control Mechanism privilege escalation
T1548.002
Bypass User Account Control privilege escalation
CVE CVE-2018-0824
›
5 Installation
8
T1558.002
Silver Ticket credential access
T1558.004
AS-REP Roasting credential access
T1007
System Service Discovery discovery
T1087.001
Local Account discovery
T1124
System Time Discovery discovery
T1135
Network Share Discovery discovery
T1518.002
Backup Software Discovery discovery
T1133
External Remote Services persistence
›
6 Command & Control
9
T1056.001
Keylogging collection
T1115
Clipboard Data collection
T1123
Audio Capture collection
T1125
Video Capture collection
T1105
Ingress Tool Transfer command and control
T1132.001
Standard Encoding command and control
T1132.002
Non-Standard Encoding command and control
T1550
Use Alternate Authentication Material lateral movement
T1550.001
Application Access Token lateral movement
›
7 Actions on Objectives
18
T1048
Exfiltration Over Alternative Protocol exfiltration
T1490
Inhibit System Recovery impact
T1498
Network Denial of Service impact
T1078
Valid Accounts stealth
T1078.004
Cloud Accounts stealth
T1127
Trusted Developer Utilities Proxy Execution stealth
T1127.001
MSBuild stealth
T1127.002
ClickOnce stealth
T1127.003
JamPlus stealth
T1134
Access Token Manipulation stealth
T1134.001
Token Impersonation/Theft stealth
T1134.002
Create Process with Token stealth
T1134.003
Make and Impersonate Token stealth
T1134.004
Parent PID Spoofing stealth
T1134.005
SID-History Injection stealth
T1130?
T1130?
T125?
T125?
T1605
T1605
Stage risk: Critical High Medium None

Tools & Malware (50)

AGINGFLY Backdoors CASTLELOADER CASTLERAT (Python/C) CastleLoader CastleRAT ClickFix Cobalt Cobalt Strike Fleetdeck GitHub Group Policy Hook Interception KongTuke Leverage LummaC2 Matanbuchus MintsLoader NetSupport RAT Netsupport Manager PDQ Connect PLUGGYAPE Payload Payload Phishing emails PlugX PowerShell PowerShell commands RATANKBA REvil Rhadamanthys Rogue Rootkit Rundll32 STOP ScreenConnect ShadowPad SimpleHelp SocGholish StealC Trojan UnmarshalPwn WhatsApp Windows Command Shell YARA inter mshta phishing systemd

Indicators of Compromise (39)

Domain
testdomain123123.shop imjp14k.dll.dat rateconfirmations.com loadsschedule.com wereatwar.com mrlogsol.ca programsbookss.com oldspicenotsogood.shop +9 more
Filename
control.exe imjp14k.dll service.exe
IPv4 Address
195.85.115.44 192.109.138.102 178.17.57.103 185.39.19.164 178.17.57.102 77.83.207.55 45.155.249.121 147.45.177.127 +11 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (5)
M1017 User Training M1021 Restrict Web-Based Content M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software
Exploitation (21)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +16 more
Installation (10)
M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration M1030 Network Segmentation +5 more
Command & Control (11)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +6 more
Actions on Objectives (19)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +14 more

Detection Coverage

46 strategies
5/7 stages covered

Delivery (1)

DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (13)

DET0018 Behavior-chain, platform-aware detection... DET0083 Container CLI and API Abuse via Docker/K... DET0202 Behavioral Detection of Windows Command... DET0224 Detect Abuse of Component Object Model (... DET0249 Behavior-chain detection for T1610 Deplo... +8 more

Installation (8)

DET0088 Backup Software Discovery via CLI, Regis... DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0151 Behavior-chain, platform-aware detection... DET0182 Behavior-chain detection for T1135 Netwo... DET0241 Detect Forged Kerberos Silver Tickets (T... +3 more

Command & Control (9)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0124 Behavior-chain detection for T1132.001 D... DET0185 Behavioral Detection Strategy for Use Al... DET0197 Behavior-chain, platform-aware detection... +4 more

Actions on Objectives (15)

DET0131 Behavioral Detection Strategy for Exfilt... DET0136 Behavior-chain detection for T1134.005 A... DET0172 Behavior-chain, platform-aware detection... DET0191 Behavior-chain detection strategy for T1... DET0283 Behavior-chain detection for T1134 Acces... +10 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

UAC-0241

Type: Unknown Active
TAG-160 TAG-161 TAG-150 a technically sophisticated impersonates Booking.com +14 more
Infrastructure 36 IOC(s)
50%
Domain
testdomain123123.shop imjp14k.dll.dat rateconfirmations.com loadsschedule.com wereatwar.com +12
IPv4 Address
195.85.115.44 192.109.138.102 178.17.57.103 185.39.19.164 178.17.57.102 +14
Artifacts (3)
control.exe imjp14k.dll service.exe
Capability
50%
49 technique(s) 50 tool(s)/malware 1 CVE(s)
AGINGFLY Backdoors CASTLELOADER CASTLERAT (Python/C) CastleLoader CastleRAT ClickFix Cobalt +42
T1130? T125? T1605
collection
T1056.001 T1115 T1123 T1125
command and control
T1105 T1132.001 T1132.002
credential access
T1558.002 T1558.004
Victim
70%

Targeted Sectors

transportation government defense education healthcare manufacturing maritime financial-services

Targeted Countries

UA US CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189

Capability (Malware)

AGINGFLY Backdoors CASTLELOADER
4 Exploitation

Capability (Malware)

AGINGFLY Backdoors CASTLELOADER
5 Installation

Capability (Malware)

AGINGFLY Backdoors CASTLELOADER
6 Command & Control

Capability (Malware)

AGINGFLY Backdoors CASTLELOADER
7 Actions on Objectives

Capability (Techniques)

T1048 T1490 T1498

Capability (Malware)

AGINGFLY Backdoors CASTLELOADER
Leaving Threaticon

This link opens an external site that isn't part of the platform.