Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ta4922 (threat actor)

Risk

High

9 techniques 46 tools/malware 1 vulnerabilities 37 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.006

Python execution

T1204

User Execution execution

CVE CVE-2022-47966

›

5 Installation

No data

›

6 Command & Control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1055

Process Injection stealth

T1574.004

Dylib Hijacking stealth

Stage risk: Critical High Medium None

Tools & Malware (46)

AnyDesk Atlas RAT BlueNoroff C2 infrastructure ClickFix Dark Daxin Expand Gh0StRAT GitHub Global GoSerpent Guard Havex RAT HoldingHands Hyper-V Leverage Malware Payloads Matrix Microsoft Teams Nexus Payload Payload Phishing campaigns PowerShell Process Hollowing RC4 encryption Remote Management Software RomulusLoader STOP Satori SilentRunLoader Spear-phishing Spear-phishing emails SyncFuture Trojan ValleyRAT ValleyRAT (Winos4.0) Void WhatsApp YARA ZLib curl dllhost malware distribution phishing

Indicators of Compromise (37)

Domain

ws.ztts88.cyou Backdoor.Daxin aeya388.club vulkaninfo.pdb srt.tw Mallory.ai

Filename

libcef.dll powershell.exe svchost.exe dllhost.exe Paperwork.zip vulkan-1.dll vulkan-1.bin cg.exe +4 more

SHA-256 Hash

4fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d 0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8 e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c 584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae8 314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef 3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d 2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d 40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5 +6 more

IPv4 Address

206.238.115.58 154.211.86.110 18.139.83.110 103.214.172.33 43.156.77.97

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (8)

M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1033 Limit Software Installation M1038 Execution Prevention +3 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (5)

M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1057 Data Loss Prevention

Detection Coverage

9 strategies

4/7 stages covered

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0063 Cross-Platform Behavioral Detection of P... DET0478 User Execution – multi-surface behavior...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (3)

DET0152 Detection Strategy for Hijack Execution... DET0348 Detection Strategy for Exfiltration Over... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

ta4922

Type: Unknown Active

tracked as tax professionals corporate finance teams data theft Italy +6 more

Infrastructure 11 IOC(s)

50%

Domain

ws.ztts88.cyou Backdoor.Daxin aeya388.club vulkaninfo.pdb srt.tw +1

IPv4 Address

206.238.115.58 154.211.86.110 18.139.83.110 103.214.172.33 43.156.77.97

Artifacts (26)

libcef.dll powershell.exe svchost.exe dllhost.exe Paperwork.zip vulkan-1.dll +20

Capability

50%

9 technique(s) 46 tool(s)/malware 1 CVE(s)

AnyDesk Atlas RAT BlueNoroff C2 infrastructure ClickFix Dark Daxin Expand +38

command and control

T1071.001 T1105

execution

T1059.006 T1204

exfiltration

T1041

initial access

T1566.001 T1566.002

Victim

70%

Targeted Sectors

financial-services healthcare government information-technology manufacturing utilities

Targeted Countries

British Indian Ocean Territory Germany India Indonesia Italy Japan Malaysia Singapore South Africa Taiwan United Kingdom of Great Britain and Northern Ireland CN GB DE JP IT IN TW SG KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

AnyDesk Atlas RAT BlueNoroff

Infrastructure

ws.ztts88.cyou Backdoor.Daxin aeya388.club

4 Exploitation

Capability (Techniques)

T1059.006 T1204

Capability (Malware)

AnyDesk Atlas RAT BlueNoroff

Infrastructure

ws.ztts88.cyou Backdoor.Daxin aeya388.club

6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

AnyDesk Atlas RAT BlueNoroff

Infrastructure

ws.ztts88.cyou Backdoor.Daxin aeya388.club

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

AnyDesk Atlas RAT BlueNoroff

Infrastructure

ws.ztts88.cyou Backdoor.Daxin aeya388.club