Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
GrayBravo (threat actor)
Risk
79
Critical
20 techniques 43 tools/malware 1 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
6
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1583.004
Server resource development
T1586.002
Email Accounts resource development
T1588.002
Tool resource development
T1650
Acquire Access resource development
›
3 Delivery
4
T1189
Drive-by Compromise initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
6
T1059.001
PowerShell execution
T1059.010
AutoHotKey & AutoIT execution
T1204
User Execution execution
T1204.002
Malicious File execution
T1204.004
Malicious Copy and Paste execution
CVE CVE-2026-20230
›
5 Installation
No data
›
6 Command & Control
4
T1005
Data from Local System collection
T1071.001
Web Protocols command and control
T1090.002
External Proxy command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
1
T1036
Masquerading stealth
Stage risk: Critical High Medium None

Tools & Malware (43)

AppDomainManager BITS C2 infrastructure CASTLELOADER CastleRAT ClickFix ClickFix technique Custom malware Dindoor GitHub Global Group Policy Hermes Hook Interception Leverage Lumma Stealer LummaC2 LummaStealer MSBuild Matanbuchus Matrix MuddyWater NetSupport RAT PLAY Payload Payload PowerShell PowerShell commands Process Hollowing RC4 encryption Rhadamanthys Rundll32 STOP SectopRAT Trojan WarmCookie YARA fast16 malware distribution netsh phishing systemd

Indicators of Compromise (40)

Domain
oldspicenotsogood.shop loadstracking.com Booking.com panelv1.hostingzealoft.today sftp.sagargolf.com ip-api.com www.ip-api.com boiksal.com +1 more
Filename
AutoIt3.exe cmd.exe
SHA-256 Hash
6444f0e3f78254aef663837562d258a2236a77f810ee8d832de7d83e0fdd5783 25e0008aba82690e0f58c9d9fcfbc5d49820aa78d2f7bfcd0b85fb969180fc04 94dc0f696a46f3c225b0aa741fbd3b8997a92126d66d7bc7c9dd8097af0de52a 53775af67e9df206ed3f9c0a3756dbbc4968a77b1df164e9baddb51e61ac82df 60125159523c356d711ffa1076211359906e6283e25f75f4cf0f9dc8da6bf7b0 1ff6ee23b4cd9ac90ee569067b9e649c76dafac234761706724ae0c1943e4a75 e6bcdf375649a7cbf092fcab65a24d832d8725d833e422e28dfa634498b00928 67cf6d5332078ff021865d5fef6dc61e90b89bc411d8344754247ccd194ff65b +1 more
IPv4 Address
15.197.240.20 185.39.19.180 92.255.57.32 176.126.163.56 192.36.57.164 178.17.57.103 34.72.90.40 94.141.122.164 +12 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more
Exploitation (10)
M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +5 more
Command & Control (3)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1057 Data Loss Prevention
Actions on Objectives (8)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

20 strategies
5/7 stages covered

Weaponization (6)

DET0838 Detection of Virtual Private Server DET0852 Detection of Tool DET0861 Detection of Email Accounts DET0871 Detection of Server DET0884 Detection of Acquire Access +1 more

Delivery (4)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (5)

DET0294 User Execution – Malicious File via down... DET0332 Detection Strategy for AutoHotKey & Auto... DET0340 User Execution – Malicious Copy & Paste... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior...

Command & Control (4)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0325 External Proxy Behavior via Outbound Rel... DET0380 Detection of Local Data Collection Prior...

Actions on Objectives (1)

DET0127 Behavioral Detection of Masquerading Acr...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

GrayBravo

Type: Unknown Active
TAG-150 tracked as a technically sophisticated TAG-160 TAG-161 +26 more
Infrastructure 29 IOC(s)
50%
Domain
oldspicenotsogood.shop loadstracking.com Booking.com panelv1.hostingzealoft.today sftp.sagargolf.com +4
IPv4 Address
15.197.240.20 185.39.19.180 92.255.57.32 176.126.163.56 192.36.57.164 +15
Artifacts (11)
AutoIt3.exe cmd.exe 6444f0e3f78254aef663837562d258a2236a77f810ee8d832de7d83e0fdd5783 25e0008aba82690e0f58c9d9fcfbc5d49820aa78d2f7bfcd0b85fb969180fc04 94dc0f696a46f3c225b0aa741fbd3b8997a92126d66d7bc7c9dd8097af0de52a 53775af67e9df206ed3f9c0a3756dbbc4968a77b1df164e9baddb51e61ac82df +5
Capability
50%
20 technique(s) 43 tool(s)/malware 1 CVE(s)
AppDomainManager BITS C2 infrastructure CASTLELOADER CastleRAT ClickFix ClickFix technique Custom malware +35
collection
T1005
command and control
T1071.001 T1090.002 T1105
execution
T1059.001 T1059.010 T1204 T1204.002 +1
initial access
T1189 T1566 T1566.001 T1566.002
Victim
70%

Targeted Sectors

transportation financial-services healthcare government hospitality defense manufacturing education critical-infrastructure maritime gaming media

Targeted Countries

US IN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

AppDomainManager BITS C2 infrastructure
3 Delivery

Capability (Malware)

AppDomainManager BITS C2 infrastructure
4 Exploitation

Capability (Malware)

AppDomainManager BITS C2 infrastructure
6 Command & Control

Capability (Malware)

AppDomainManager BITS C2 infrastructure
Leaving Threaticon

This link opens an external site that isn't part of the platform.