Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
tag-179 (threat actor)
Risk
96
Critical
34 techniques 41 tools/malware 26 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
6
T1583.004
Server resource development
T1585.002
Email Accounts resource development
T1587.001
Malware resource development
T1588.002
Tool resource development
T1608.001
Upload Malware resource development
T1608.005
Link Target resource development
›
3 Delivery
1
T1566.002
Spearphishing Link initial access
›
4 Exploitation
29
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1204.002
Malicious File execution
CVE CVE-2014-6287
CVE CVE-2017-0144
CVE CVE-2017-0145
CVE CVE-2017-10271
CVE CVE-2017-11882
CVE CVE-2017-8464
CVE CVE-2017-9791
CVE CVE-2018-1000861
CVE CVE-2018-20062
CVE CVE-2018-7600
CVE CVE-2019-9081
CVE CVE-2022-42475
CVE CVE-2023-33538
CVE CVE-2023-39780
CVE CVE-2024-3400
CVE CVE-2025-0921
CVE CVE-2025-14847
CVE CVE-2025-22457
CVE CVE-2025-40947
CVE CVE-2025-40948
CVE CVE-2026-0257
CVE CVE-2026-0300
CVE CVE-2026-1281
CVE CVE-2026-1340
CVE CVE-2026-1731
CVE CVE-2026-31431
›
5 Installation
9
T1012
Query Registry discovery
T1016
System Network Configuration Discovery discovery
T1016.001
Internet Connection Discovery discovery
T1016.002
Wi-Fi Discovery discovery
T1033
System Owner/User Discovery discovery
T1049
System Network Connections Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
8
T1005
Data from Local System collection
T1025
Data from Removable Media collection
T1056.001
Keylogging collection
T1071.001
Web Protocols command and control
T1090
Proxy command and control
T1105
Ingress Tool Transfer command and control
T1573
Encrypted Channel command and control
T1091
Replication Through Removable Media lateral movement
›
7 Actions on Objectives
7
T1027
Obfuscated Files or Information stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1070.009
Clear Persistence stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1564.001
Hidden Files and Directories stealth
T1574.002
T1574.002
T9000
T9000
Stage risk: Critical High Medium None

Tools & Malware (41)

Backdoors Bazar BeaverTail Bisonal Cobalt Cobalt Strike Cyclops Blink DOPLUGS Dark Explorer GitHub Global GolangGhost Havoc Hydraq InvisibleFerret Kimsuky LODEINFO Lambert Lucifer Nexus Payload Payload PlugX PowerShell PylangGhost Remcos Ryuk ShadowPad Spear-phishing SysUpdate TrickBot Trojan Turla WellMess ifconfig ipconfig nbtstat netsh phishing route

Indicators of Compromise (40)

Domain
gmail.com cms.balochistanpolice.gov.pk InstanceFinderDlg.dat qf2020.top NoteLogger.dat spread.txt log.dat Trojan.Hydraq +1 more
Filename
svchostlong.exe cmd.exe schtasks.exe msi.dll WerFault.exe spreadXfghij.exe HPSmart.exe InstanceFinderDlgUI.dll +7 more
MD5 Hash
bb167fc8cdca3b8c009dab3ec460be7c
SHA-256 Hash
8edbcd63def33827bfd63bffce4a15ba83e88908f9ac9962f10431f571ba07a8 5214f356f2e8640230e93a95633cd73945c38027b23e76bb5e617c71949f8994
IPv4 Address
172.111.233.36 172.94.9.49 172.111.233.105 172.94.9.43 45.131.179.179 89.31.121.220 193.42.25.65 188.43.33.252 +5 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (5)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1054 Software Configuration
Exploitation (7)
M1017 User Training M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +2 more
Command & Control (7)
M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic M1040 Behavior Prevention on Endpoint +2 more
Actions on Objectives (8)
M1017 User Training M1022 Restrict File and Directory Permissions M1029 Remote Data Storage M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

32 strategies
6/7 stages covered

Weaponization (6)

DET0824 Detection of Upload Malware DET0835 Detection of Email Accounts DET0852 Detection of Tool DET0871 Detection of Server DET0872 Detection of Malware +1 more

Delivery (1)

DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (3)

DET0294 User Execution – Malicious File via down... DET0364 Behavioral Detection Strategy for WMI Ex... DET0441 Detection of Suspicious Scheduled Task C...

Installation (9)

DET0093 Behavioral Detection of User Discovery v... DET0195 Behavioral Detection of System Network C... DET0209 Detection of Registry Query for Environm... DET0320 Detection of System Network Connections... DET0357 Behavioral Detection of Internet Connect... +4 more

Command & Control (8)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0273 Detection Strategy for Encrypted Channel... DET0301 Removable Media Execution Chain Detectio... +3 more

Actions on Objectives (5)

DET0032 Detection Strategy for Hidden Files and... DET0040 Detection of Persistence Artifact Remova... DET0275 Detect Adversary Deobfuscation or Decodi... DET0347 Detection Strategy for Masquerading via... DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

tag-179

Type: Unknown Active
tracked as local Tech Sectors Advanced Persistent Threat 39 Chafer +7 more
Infrastructure 22 IOC(s)
50%
Domain
gmail.com cms.balochistanpolice.gov.pk InstanceFinderDlg.dat qf2020.top NoteLogger.dat +4
IPv4 Address
172.111.233.36 172.94.9.49 172.111.233.105 172.94.9.43 45.131.179.179 +8
Artifacts (18)
svchostlong.exe cmd.exe schtasks.exe msi.dll WerFault.exe spreadXfghij.exe +12
Capability
50%
34 technique(s) 41 tool(s)/malware 26 CVE(s)
Backdoors Bazar BeaverTail Bisonal Cobalt Cobalt Strike Cyclops Blink DOPLUGS +33
T1574.002 T9000
collection
T1005 T1025 T1056.001
command and control
T1071.001 T1090 T1105 T1573
discovery
T1012 T1016 T1016.001 T1016.002 +4
Victim
70%

Targeted Sectors

government financial-services defense telecommunications critical-infrastructure information-technology energy healthcare manufacturing non-profit hospitality education transportation aviation maritime food-agriculture construction media think-tank gaming

Targeted Countries

Pakistan CN IN PK AE TW VN US UA RU JP IR PL KR MX BY CA KP SG RO NL IT

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

Backdoors Bazar BeaverTail
3 Delivery

Capability (Techniques)

T1566.002

Capability (Malware)

Backdoors Bazar BeaverTail
4 Exploitation

Capability (Techniques)

T1047 T1053.005 T1204.002

Capability (Malware)

Backdoors Bazar BeaverTail
5 Installation

Capability (Malware)

Backdoors Bazar BeaverTail
6 Command & Control

Capability (Malware)

Backdoors Bazar BeaverTail
Leaving Threaticon

This link opens an external site that isn't part of the platform.