Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Narketing163 (threat actor)
Risk
58
High
12 techniques 50 tools/malware 0 vulnerabilities 9 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
3
T1047
Windows Management Instrumentation execution
T1053
Scheduled Task/Job execution
T1059.001
PowerShell execution
›
5 Installation
2
T1098
Account Manipulation persistence
T1543.003
Windows Service persistence
›
6 Command & Control
1
T1021.004
SSH lateral movement
›
7 Actions on Objectives
6
T1486
Data Encrypted for Impact impact
T1490
Inhibit System Recovery impact
T1070.006
Timestomp stealth
T1070.001
T1070.001
T1075
T1075
T1076
T1076
Stage risk: Critical High Medium None

Tools & Malware (50)

404 Keylogger Agent Tesla Akira Alphv BLINDINGCAN Backdoors BlackByte BlackCat Carbanak Clop Cobalt Cobalt Strike Conti Custom malware Dark Decryptor Tools FormBook Ghost RAT Global Guard Hafnium Hive InvisibleFerret Kimsuky LockBit Medusa Naikon Nexus NotPetya Open-source tools Payload Payload PlugX PowerShell PowerShell scripts PsExec REvil Ransomware variants RedLine RedLine Stealer Remote access tools STOP Snake Keylogger Starland RAT Trojan WLDR C2 implant WMI queries Winnti malware distribution phishing

Indicators of Compromise (9)

Domain
TEMP.VelesTEMP.Veles Digit.fyi consequences.Investigations TEMP.hermit Kamikaze.sh 163.com
Email Address
commercial@malwarepatrol.net narketing163@gmail.com
Filename
GA.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

13 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Exploitation (10)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +5 more
Installation (10)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation +5 more
Command & Control (3)
M1018 User Account Management M1032 Multi-factor Authentication M1042 Disable or Remove Feature or Program
Actions on Objectives (5)
M1018 User Account Management M1028 Operating System Configuration M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1053 Data Backup

Detection Coverage

9 strategies
4/7 stages covered

Exploitation (3)

DET0094 Cross-Platform Behavioral Detection of S... DET0364 Behavioral Detection Strategy for WMI Ex... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (2)

DET0096 Account Manipulation Behavior Chain Dete... DET0552 Detection of Windows Service Creation or...

Command & Control (1)

DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (3)

DET0215 Detection of Multi-Platform File Encrypt... DET0329 Behavioral Detection for T1490 - Inhibit... DET0591 Cross-Platform Behavioral Detection of F...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

Narketing163

Type: Unknown Active
APT28 tracked as Pawn Storm Fancy Bear Sandworm Team +7 more
Infrastructure 6 IOC(s)
50%
Domain
TEMP.VelesTEMP.Veles Digit.fyi consequences.Investigations TEMP.hermit Kamikaze.sh +1
Artifacts (3)
commercial@malwarepatrol.net narketing163@gmail.com GA.js
Capability
50%
12 technique(s) 50 tool(s)/malware
404 Keylogger Agent Tesla Akira Alphv BLINDINGCAN Backdoors BlackByte BlackCat +42
T1070.001 T1075 T1076
execution
T1047 T1053 T1059.001
impact
T1486 T1490
lateral movement
T1021.004
Victim
70%

Targeted Sectors

government financial-services defense telecommunications healthcare education manufacturing critical-infrastructure non-profit media energy information-technology hospitality aerospace pharmaceutical aviation retail think-tank transportation mining chemical gaming maritime entertainment oil-gas legal-services nuclear construction utilities

Targeted Countries

US CN RU IR JP UA VN IL SA GB AU PK TW KR IN KP SG DE AE BY AZ TR MX ES PL CA RO FR NG IT LB KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Techniques)

T1047 T1053 T1059.001

Capability (Malware)

404 Keylogger Agent Tesla Akira
5 Installation

Capability (Techniques)

T1098 T1543.003

Capability (Malware)

404 Keylogger Agent Tesla Akira
6 Command & Control

Capability (Techniques)

T1021.004

Capability (Malware)

404 Keylogger Agent Tesla Akira
7 Actions on Objectives

Capability (Techniques)

T1486 T1490

Capability (Malware)

404 Keylogger Agent Tesla Akira
Leaving Threaticon

This link opens an external site that isn't part of the platform.