Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

CashRewindo (threat actor)

Risk

High

4 techniques 47 tools/malware 19 vulnerabilities 32 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

CVE CVE-2017-6742

CVE CVE-2020-1380

CVE CVE-2021-25337

CVE CVE-2021-25369

CVE CVE-2021-25370

CVE CVE-2021-38003

CVE CVE-2022-0543

CVE CVE-2022-42475

CVE CVE-2022-45359

CVE CVE-2023-20867

CVE CVE-2023-27350

CVE CVE-2023-27352

CVE CVE-2023-27353

CVE CVE-2023-27354

CVE CVE-2023-27355

CVE CVE-2023-2868

CVE CVE-2023-34048

CVE CVE-2023-34362

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1055.001 – Process Injection

T1071.001 – Application Layer Protocol (HTTP/HTTPS) C2

T1189 – Drive‑by Compromise

T1204 – User Execution

Stage risk: Critical High Medium None

Tools & Malware (47)

Backdoors BlueNoroff Buhtrap Camaro Dragon Cobalt Cobalt Strike Crimson Custom JavaScript downloader scripts Custom malware Dark DarkHotel Domain‑based malvertising infrastructure Embedded malicious libraries in legitimate JS bundles GitHub Global Google Drive IcedID Jackal Kimsuky LNK files Leverage Matrix MuddyWater Naikon Nexus Payload Payload Phishing emails PlugX Poseidon PowerShell ROKRAT RedLine Rogue Royal SentinelOne Spear-phishing TeamSpy Trojan Tsunami Turla Unknown VICEROY Void WhatsApp gcman phishing

Indicators of Compromise (32)

Domain

reserved.English TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie TEMP.Noble +16 more

Filename

msvcr100.dll utilman.exe w3wp.exe noblox.js Wordconv.exe PARIVAHAN.apk

IPv4 Address

5.1.3.001 9.2.0.006

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

CashRewindo

Type: Unknown Active

APT28 Earth Preta Pawn Storm Fancy Bear RedDelta +132 more

Infrastructure 26 IOC(s)

50%

Domain

reserved.English TEMP.Veles Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo +19

IPv4 Address

5.1.3.001 9.2.0.006

Artifacts (6)

msvcr100.dll utilman.exe w3wp.exe noblox.js Wordconv.exe PARIVAHAN.apk

Capability

50%

4 technique(s) 47 tool(s)/malware 19 CVE(s)

Backdoors BlueNoroff Buhtrap Camaro Dragon Cobalt Cobalt Strike Crimson Custom JavaScript downloader scripts +39

T1055.001 – Process Injection T1071.001 – Application Layer Protocol (HTTP/HTTPS) C2 T1189 – Drive‑by Compromise T1204 – User Execution

Victim

70%

Targeted Sectors

government defense financial-services telecommunications non-profit education energy media healthcare maritime critical-infrastructure aerospace manufacturing transportation information-technology chemical think-tank nuclear pharmaceutical retail gaming hospitality mining entertainment oil-gas legal-services utilities

Targeted Countries

CN US UA IN RU IR JP PK GB DE TW IL SA KR KP TR FR CA AU PL VN KZ BR ES IT IQ AE SG NL SY MX BY AZ RO EG

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges