Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

CL-STA-1009 (threat actor)

Risk

Medium

2 techniques 49 tools/malware 0 vulnerabilities 22 IOCs 1/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

No data

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1179

T1574.001 -DLL Side-loading:Load Commonly Used Tools

Stage risk: Critical High Medium None

Tools & Malware (49)

3001 ASPXTool Airstalk Airstalk malware Backdoors China Chopper China Chopper webshell Cobalt Crisis Deputy Derusbi Derusbi Explosive Gh0st Ghost RAT GitHub Global HTRAN HTTPBrowser Hunter Impacket Information Stealers Leverage MESSAGETAP NBTscan NET-STAR Nexus Ninja Ntospy PlugX PowerShell PowerShell scripts STOP Specter Trojan Unknown VShell Vidar Vidar stealer Web Shell Wevtutil WildFire Winnti XCSSET curl gh0st RAT gsecdump npm packages wce

Indicators of Compromise (22)

Domain

Assembly.Load ServerCore.pdb ExecuteAssembly.pdb demo-cloud.space OutlookEN.aspx KonBriefing.com

Filename

w3wp.exe ServerCore.dll ExecuteAssembly.dll services.exe mssq.bat

MD5 Hash

29afb8d913db84fdb362f4fd927b8553

SHA-256 Hash

b76e243cf1886bd0e2357cbc7e1d2812c2c0ecc5068e61d681e0d5cff5b8e038 0c444624af1c9cce6532a6f88786840ebce6ed3df9ed570ac75e07e30b0c0bde 1f8f494cc75344841e77d843ef53f8c5f1beaa2f464bcbe6f0aacf2a0757c8b5 dfdc27d81a6a21384d6dba7dcdc4c7f9348cf1bdc6df7521b886108b71b41533 b6d37334034cd699a53df3e0bcac5bbdf32d52b4fa4944e44488bd2024ad719b 4e4cbaed015dfbda3c368ca4442cd77a0a2d5e65999cd6886798495f2c29fcd5 3a48ea6857f1b6ae28bd1f4a07990a080d854269b1c1563c9b2e330686eb23b5 eeed5530fa1cdeb69398dc058aaa01160eab15d4dcdcd6cb841240987db284dc +2 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

CL-STA-1009

Type: Unknown Active

tracked as APT27 CL-STA-0043 Winnti Mustang Panda +20 more

Infrastructure 6 IOC(s)

50%

Domain

Assembly.Load ServerCore.pdb ExecuteAssembly.pdb demo-cloud.space OutlookEN.aspx +1

Artifacts (16)

w3wp.exe ServerCore.dll ExecuteAssembly.dll services.exe mssq.bat 29afb8d913db84fdb362f4fd927b8553 +10

Capability

65%

2 technique(s) 49 tool(s)/malware

3001 ASPXTool Airstalk Airstalk malware Backdoors China Chopper China Chopper webshell Cobalt +41

T1179 T1574.001 -DLL Side-loading:Load Commonly Used Tools

Victim

70%

Targeted Sectors

government telecommunications critical-infrastructure financial-services transportation manufacturing defense education healthcare pharmaceutical energy utilities nuclear food-agriculture chemical mining non-profit maritime think tank

Targeted Countries

US CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges