Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
IronErn440 (threat actor)
Risk
70
High
8 techniques 76 tools/malware 3 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
6
T1053
Scheduled Task/Job execution
T1059.003
Windows Command Shell execution
T1204.002
Malicious File execution
CVE CVE-2015-1701
CVE CVE-2023-46604
CVE CVE-2023-48022
›
5 Installation
1
T1552.001
Credentials In Files credential access
›
6 Command & Control
1
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
1
T1036
Masquerading stealth
Stage risk: Critical High Medium None

Tools & Malware (76)

9002 RAT Akira Backdoors Buhtrap CRASHPAD Chinastrats CloudDuke Cobalt ComeBacker CosmicDuke CozyDuke DCSYNCER.SLICK DEADEYE DEEPROOT Dark DarkHotel Dropping Elephant ELMER Formbook GHOSTLINE GeminiDuke GitHub Global HammerDuke Hammertoss Hellsing Hidden Cobra IRONHALO IronErn440 Jackal LIGHTRAIL Lynx MAYBEROBOT MINIBIKE Matrix MiniDionis MiniDuke Mirage MuddyWater NOROBOT Naikon Nexus Nitro OnionDuke POLLBLEND Patchwork Phoenix PinchDuke Poison Ivy Poseidon PowerShell Predator Rigel GPU miner SIGHTGRAB Samurai SeaDuke ShadowRay 2.0 Shamoon Shark Spear-phishing TRUSTTRAP TWOSTROKE TeamSpy Tsunami Turla UNC1549 Unknown VICEROY Void WhatsApp XMRig YESROBOT gcman phishing sockstress systemd

Indicators of Compromise (39)

Domain
demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie +16 more
Filename
rundll32.exe rider.exe sysprocupdate.exe WindowsUpdateService.vbs githubdesktop.exe word.exe OneDrive.exe googlemaps.exe +7 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (8)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +3 more
Installation (4)
M1017 User Training M1022 Restrict File and Directory Permissions M1027 Password Policies M1047 Audit
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (8)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

8 strategies
5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down...

Installation (1)

DET0307 Detect Access to Unsecured Credential Fi...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (1)

DET0127 Behavioral Detection of Masquerading Acr...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

IronErn440

Type: Unknown Active
PCPcat ShellForce CipherForce DeadCatx3 CanisterWorm +44 more
Infrastructure 24 IOC(s)
50%
Domain
demo-cloud.space TEMP.Hermit TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers +19
Artifacts (15)
rundll32.exe rider.exe sysprocupdate.exe WindowsUpdateService.vbs githubdesktop.exe word.exe +9
Capability
50%
8 technique(s) 76 tool(s)/malware 3 CVE(s)
9002 RAT Akira Backdoors Buhtrap CRASHPAD Chinastrats CloudDuke Cobalt +68
command and control
T1105
credential access
T1552.001
execution
T1053 T1059.003 T1204.002
initial access
T1190 T1566.001
Victim
70%

Targeted Sectors

government defense financial-services non-profit aerospace energy telecommunications education media information-technology think-tank mining healthcare manufacturing maritime pharmaceutical critical-infrastructure aviation chemical transportation oil-gas utilities food-agriculture hospitality legal-services nuclear entertainment

Targeted Countries

US CN GB IN IR JP DE RU KR SA FR CA TW IL AU KZ TR UA PK AE VN PL BY KP AZ SG NL BR ES IQ IT SY MX RO EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

9002 RAT Akira Backdoors
4 Exploitation

Capability (Techniques)

T1053 T1059.003 T1204.002

Capability (Malware)

9002 RAT Akira Backdoors
5 Installation

Capability (Techniques)

T1552.001

Capability (Malware)

9002 RAT Akira Backdoors
6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

9002 RAT Akira Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.