Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

dprk (threat actor)

Risk

Critical

40 techniques 41 tools/malware 2 vulnerabilities 120 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1584

Compromise Infrastructure resource development

T1585

Establish Accounts resource development

T1586

Compromise Accounts resource development

T1587

Develop Capabilities resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1546

Event Triggered Execution privilege escalation

CVE CVE-2016-0034

CVE CVE-2020-0688

›

5 Installation

T1555

Credentials from Password Stores credential access

T1557

Adversary-in-the-Middle credential access

T1033

System Owner/User Discovery discovery

T1082

System Information Discovery discovery

T1217

Browser Information Discovery discovery

T1098

Account Manipulation persistence

T1136

Create Account persistence

T1543

Create or Modify System Process persistence

T1547

Boot or Logon Autostart Execution persistence

›

6 Command & Control

T1005

Data from Local System collection

T1074

Data Staged collection

T1114

Email Collection collection

T1115

Clipboard Data collection

T1185

Browser Session Hijacking collection

T1560

Archive Collected Data collection

T1071

Application Layer Protocol command and control

T1105

Ingress Tool Transfer command and control

T1132

Data Encoding command and control

T1219

Remote Access Tools command and control

T1568

Dynamic Resolution command and control

›

7 Actions on Objectives

T1685

Disable or Modify Tools defense impairment

T1686

Disable or Modify System Firewall defense impairment

T1020

Automated Exfiltration exfiltration

T1041

Exfiltration Over C2 Channel exfiltration

T1567

Exfiltration Over Web Service exfiltration

T1657

Financial Theft impact

T1027

Obfuscated Files or Information stealth

T1036

Masquerading stealth

T1078

Valid Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1480

Execution Guardrails stealth

T1678

Delay Execution stealth

Stage risk: Critical High Medium None

Tools & Malware (41)

APT38 AppleJeus BeaverTail BlueNoroff Citrine Sleet CollectionRAT ComeBacker FULLHOUSE GitHub Gleaming Pisces Global HLOADER Hermit Hidden Cobra InvisibleFerret KANDYKORN Kimsuky Labyrinth Chollima Leverage Matrix Mimikatz OdicLoader OtterCookie POOLRAT Payload Payload PondRAT PowerShell PowerShell scripts Python scripts Rundll32 RustBucket SUGARLOADER TEMP.Hermit TRANSLATEXT Trojan UpdateAgent WannaCry Windows Command Shell npm packages phishing

Indicators of Compromise (120)

Domain

azuredeploystore.com msstorageazure.com msstorageboxes.com officeaddons.com officestoragebox.com sourceslabs.com visualstudiofactory.com coalink.support +47 more

Filename

index.js

SHA-256 Hash

a03d13c9825e150810e6e6aaf053d71ec5a53b86581414dd982a74d4a8bc5475 927b3564c1cf884d2a05e1d7bd24362ce8563a1e9b85be776190ab7f8af192f6 c6a48365c3db9761bd60981bdcdd87aced23d8e60067caa30fee501bf4b47b84 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 479038eb12ed07893ee0dcc04fbdcf182489bbb271f5a4f90f83874881a80ce3 2546d239a262c24a6f8ea01d890cbc459a22db79b379b6ec3b24fbb56efb5381 5009c7d1590c1f8c05827122172583ddf924c53b55a46826abf66da46725505a 87c5d0c93b80acf61d24e7aaf0faae231ab507ca45483ad3d441b5d1acebc43c +14 more

IPv4 Address

23.254.226.90 144.172.110.53 103.81.116.10 88.119.171.59 23.27.20.187

URL

http://144.172.110.53 http://bmxkaz.v6.rocks http://tattomc.com http://dywkdfue.shop http://prvservice.com http://88.119.171.59 http://hmlrluaxji.v6.rocks http://techcross-es.com +29 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

34 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (10)

M1021 Restrict Web-Based Content M1026 Privileged Account Management M1033 Limit Software Installation M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +5 more

Installation (19)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1027 Password Policies +14 more

Command & Control (13)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +8 more

Actions on Objectives (21)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +16 more

Detection Coverage

40 strategies

6/7 stages covered

Weaponization (5)

DET0853 Detection of Develop Capabilities DET0873 Detection of Establish Accounts DET0876 Detection of Compromise Accounts DET0885 Detection of Compromise Infrastructure DET0895 Detection of Acquire Infrastructure

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (2)

DET0010 Behavioral Detection of Event Triggered... DET0516 Behavioral Detection of Command and Scri...

Installation (9)

DET0013 Detection of Local Browser Artifact Acce... DET0093 Behavioral Detection of User Discovery v... DET0096 Account Manipulation Behavior Chain Dete... DET0274 Boot or Logon Autostart Execution Detect... DET0296 Detect Adversary-in-the-Middle via Netwo... +4 more

Command & Control (11)

DET0014 Detection of Data Staging Prior to Exfil... DET0039 Detection Strategy for Dynamic Resolutio... DET0060 Detect Ingress Tool Transfers via Behavi... DET0108 Detection Strategy for Data Encoding in... DET0341 Clipboard Data Access with Anomalous Con... +6 more

Actions on Objectives (12)

DET0127 Behavioral Detection of Masquerading Acr... DET0145 Detection of Disabled or Modified System... DET0275 Detect Adversary Deobfuscation or Decodi... DET0348 Detection Strategy for Exfiltration Over... DET0372 Multi-Platform Detection Strategy for T1... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

dprk

Type: Unknown Active

APT38 tracked as Bluenoroff cryptocurrency businesses ATMs +29 more

Infrastructure 97 IOC(s)

50%

Domain

azuredeploystore.com msstorageazure.com msstorageboxes.com officeaddons.com officestoragebox.com +50

IPv4 Address

23.254.226.90 144.172.110.53 103.81.116.10 88.119.171.59 23.27.20.187

URL

http://144.172.110.53 http://bmxkaz.v6.rocks http://tattomc.com http://dywkdfue.shop http://prvservice.com +32

Artifacts (23)

index.js a03d13c9825e150810e6e6aaf053d71ec5a53b86581414dd982a74d4a8bc5475 927b3564c1cf884d2a05e1d7bd24362ce8563a1e9b85be776190ab7f8af192f6 c6a48365c3db9761bd60981bdcdd87aced23d8e60067caa30fee501bf4b47b84 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 479038eb12ed07893ee0dcc04fbdcf182489bbb271f5a4f90f83874881a80ce3 +17

Capability

50%

40 technique(s) 41 tool(s)/malware 2 CVE(s)

APT38 AppleJeus BeaverTail BlueNoroff Citrine Sleet CollectionRAT ComeBacker FULLHOUSE +33

collection

T1005 T1074 T1114 T1115 +2

command and control

T1071 T1105 T1132 T1219 +1

credential access

T1555 T1557

defense impairment

T1685 T1686

Victim

70%

Targeted Sectors

financial-services government critical-infrastructure defense retail healthcare think-tank media energy gaming education manufacturing nuclear entertainment transportation utilities

Targeted Countries

United States of America Latvia KP US KR RU JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1584 T1585 T1586 T1587

Capability (Malware)

APT38 AppleJeus BeaverTail

Infrastructure

azuredeploystore.com msstorageazure.com msstorageboxes.com

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

APT38 AppleJeus BeaverTail

Infrastructure

azuredeploystore.com msstorageazure.com msstorageboxes.com

4 Exploitation

Capability (Techniques)

T1059 T1546

Capability (Malware)

APT38 AppleJeus BeaverTail

Infrastructure

azuredeploystore.com msstorageazure.com msstorageboxes.com

5 Installation

Capability (Techniques)

T1555 T1557 T1033 T1082 T1217

Capability (Malware)

APT38 AppleJeus BeaverTail

Infrastructure

azuredeploystore.com msstorageazure.com msstorageboxes.com

6 Command & Control

Capability (Techniques)

T1005 T1074 T1114 T1115 T1185

Capability (Malware)

APT38 AppleJeus BeaverTail

Infrastructure

azuredeploystore.com msstorageazure.com msstorageboxes.com

7 Actions on Objectives

Capability (Techniques)

T1020 T1041 T1567 T1657

Capability (Malware)

APT38 AppleJeus BeaverTail

Infrastructure

azuredeploystore.com msstorageazure.com msstorageboxes.com