Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
CL-STA-1020 (threat actor)
Risk
85
Critical
49 techniques 43 tools/malware 0 vulnerabilities 40 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
12
T1589.001
Credentials reconnaissance
T1590.002
DNS reconnaissance
T1591.001
Determine Physical Locations reconnaissance
T1591.002
Business Relationships reconnaissance
T1592.004
Client Configurations reconnaissance
T1593
Search Open Websites/Domains reconnaissance
T1594
Search Victim-Owned Websites reconnaissance
T1595
Active Scanning reconnaissance
T1596.001
DNS/Passive DNS reconnaissance
T1596.003
Digital Certificates reconnaissance
T1596.004
CDNs reconnaissance
T1598
Phishing for Information reconnaissance
›
2 Weaponization
13
T1583
Acquire Infrastructure resource development
T1583.002
DNS Server resource development
T1583.005
Botnet resource development
T1584
Compromise Infrastructure resource development
T1584.002
DNS Server resource development
T1584.005
Botnet resource development
T1585
Establish Accounts resource development
T1586
Compromise Accounts resource development
T1587
Develop Capabilities resource development
T1587.002
Code Signing Certificates resource development
T1587.003
Digital Certificates resource development
T1588.003
Code Signing Certificates resource development
T1588.004
Digital Certificates resource development
›
3 Delivery
2
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
2
T1059
Command and Scripting Interpreter execution
T1204
User Execution execution
›
5 Installation
6
T1528
Steal Application Access Token credential access
T1557.002
ARP Cache Poisoning credential access
T1558.004
AS-REP Roasting credential access
T1580
Cloud Infrastructure Discovery discovery
T1133
External Remote Services persistence
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
6
T1213
Data from Information Repositories collection
T1602
Data from Configuration Repository collection
T1071
Application Layer Protocol command and control
T1105
Ingress Tool Transfer command and control
T1573
Encrypted Channel command and control
T1021
Remote Services lateral movement
›
7 Actions on Objectives
8
T1600.002
Disable Crypto Hardware defense impairment
T1020
Automated Exfiltration exfiltration
T1020.001
Traffic Duplication exfiltration
T1027
Obfuscated Files or Information stealth
T1070
Indicator Removal stealth
T1078
Valid Accounts stealth
T1218
System Binary Proxy Execution stealth
T1562.008
T1562.008
Stage risk: Critical High Medium None

Tools & Malware (43)

AWS CLI AWS Lambda AsyncRAT BLINDINGCAN Backdoors BlackSuit BlackSuit ransomware CLAIMLOADER Crimson DNSpionage Dark Explorer Gh0st GitHub Global Google Drive HIUPAN HazyBeacon Hi-Zor Leverage MASOL Malicious files OilRig PUBLOAD Payload Payload PowerShell Remote access tools STOP SYNful Knock Sofacy Trojan TruffleHog Turla Unknown Vidar Vidar stealer WildFire gh0st RAT npm packages phishing scanbox systemd

Indicators of Compromise (40)

Domain
laichingte.net webmail.homesmountain.com webmail.rpcthai.com changelog.json example.timer example.service activity.Monitor Server.Adversaries +3 more
Filename
version.dll google.exe mscorsvw.exe igfx.exe spoolsv.exe mscorsvc.dll regsvr32.exe 7z.exe +9 more
SHA-256 Hash
58ed0463d4cb393cd09198a6409591b39cae06bb0ba5f5d760186de88410f6b8 11c7728697d5ea11c592fee213063c6369340051157f71ddc7ca891f5f367720 4b29b74798a4e6538f2ba245c57be82953383dc91fe0a91b984b903d12043e92 835795aa494021752f21fbef63c81227c1b934437a02aa1f2a258c9f60b0b7a3 851d57a2bf514202f54dafa1eb83a862653be7512b6e9535914b8d1d719d495f 1aa37a477c539edf25656a300002a28d4246ec83344422dd705b42d3443a2623 05995284b59ad0066350f43517382228f7eee63cd297e787b2a271f69ecf2dfc 6caa78943939bd7518f5e7eaa44fa778d0db8b822e260d7fe281cf45513f82d9 +4 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (5)
M1013 Application Developer Guidance M1017 User Training M1047 Audit M1054 Software Configuration M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (11)
M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more
Installation (12)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1027 Password Policies M1030 Network Segmentation +7 more
Command & Control (15)
M1017 User Training M1018 User Account Management M1020 SSL/TLS Inspection M1027 Password Policies M1030 Network Segmentation +10 more
Actions on Objectives (20)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +15 more

Detection Coverage

48 strategies
7/7 stages covered

Reconnaissance (12)

DET0806 Detection of Determine Physical Location... DET0809 Detection of CDNs DET0810 Detection of Search Victim-Owned Website... DET0813 Detection of Credentials DET0820 Detection of Client Configurations +7 more

Weaponization (13)

DET0833 Detection of Code Signing Certificates DET0837 Detection of Botnet DET0844 Detection of Digital Certificates DET0848 Detection of Digital Certificates DET0853 Detection of Develop Capabilities +8 more

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0478 User Execution – multi-surface behavior... DET0516 Behavioral Detection of Command and Scri...

Installation (6)

DET0113 Detect AS-REP Roasting Attempts (T1558.0... DET0169 Detection Strategy for Cloud Infrastruct... DET0274 Boot or Logon Autostart Execution Detect... DET0354 Behavior-chain detection for T1133 Exter... DET0387 Detect ARP Cache Poisoning Across Linux,... +1 more

Command & Control (6)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0269 Behavioral Detection Strategy for Remote... DET0273 Detection Strategy for Encrypted Channel... DET0413 Abuse of Information Repositories for Da... DET0444 Detection of Command and Control Over Ap... +1 more

Actions on Objectives (7)

DET0081 Detection of Proxy Execution via Trusted... DET0184 Behavioral Detection of Indicator Remova... DET0378 Behavioral Detection of Obfuscated Files... DET0397 Automated Exfiltration Detection Strateg... DET0403 Detection Strategy for Traffic Duplicati... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

CL-STA-1020

Type: Unknown Active
tracked as HIUPAN EggStreme Agent Gorem RAT
Infrastructure 11 IOC(s)
50%
Domain
laichingte.net webmail.homesmountain.com webmail.rpcthai.com changelog.json example.timer +6
Artifacts (29)
version.dll google.exe mscorsvw.exe igfx.exe spoolsv.exe mscorsvc.dll +23
Capability
50%
49 technique(s) 43 tool(s)/malware
AWS CLI AWS Lambda AsyncRAT BLINDINGCAN Backdoors BlackSuit BlackSuit ransomware CLAIMLOADER +35
T1562.008
collection
T1213 T1602
command and control
T1071 T1105 T1573
credential access
T1528 T1557.002 T1558.004
Victim
70%

Targeted Sectors

government media critical-infrastructure defense utilities energy

Targeted Countries

US CN SG IL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Malware)

AWS CLI AWS Lambda AsyncRAT
2 Weaponization

Capability (Malware)

AWS CLI AWS Lambda AsyncRAT
3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

AWS CLI AWS Lambda AsyncRAT
4 Exploitation

Capability (Techniques)

T1059 T1204

Capability (Malware)

AWS CLI AWS Lambda AsyncRAT
5 Installation

Capability (Malware)

AWS CLI AWS Lambda AsyncRAT
6 Command & Control

Capability (Malware)

AWS CLI AWS Lambda AsyncRAT
7 Actions on Objectives

Capability (Techniques)

T1020 T1020.001

Capability (Malware)

AWS CLI AWS Lambda AsyncRAT
Leaving Threaticon

This link opens an external site that isn't part of the platform.