Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

unk_masstraction (threat actor)

Risk

Critical

40 techniques 45 tools/malware 9 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.001

Domains resource development

›

3 Delivery

No data

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059

Command and Scripting Interpreter execution

T1129

Shared Modules execution

T1546.003

Windows Management Instrumentation Event Subscription privilege escalation

CVE CVE-2017-11882

CVE CVE-2023-2868

CVE CVE-2024-4200

CVE CVE-2024-42009

CVE CVE-2025-49113

CVE CVE-2025-62215

CVE CVE-2026-41089

CVE CVE-2026-50522

CVE CVE-2026-9695

›

5 Installation

T1007

System Service Discovery discovery

T1012

Query Registry discovery

T1033

System Owner/User Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1135

Network Share Discovery discovery

T1518

Software Discovery discovery

T1543.003

Windows Service persistence

›

6 Command & Control

T1074

Data Staged collection

T1071

Application Layer Protocol command and control

›

7 Actions on Objectives

T1222

File and Directory Permissions Modification defense impairment

T1489

Service Stop impact

T1490

Inhibit System Recovery impact

T1027

Obfuscated Files or Information stealth

T1055

Process Injection stealth

T1070.004

File Deletion stealth

T1202

Indirect Command Execution stealth

T1497.001

System Checks stealth

T1564.003

Hidden Window stealth

T1399

T1406

T1407

T1414

T1418

T1420

T1421

T1430

T1437

T1512

T1513

T1517

T1632

T1636

T1892

Stage risk: Critical High Medium None

Tools & Malware (45)

ABCDoor AsyncRAT Aurora Backdoor malware Bulletproof hosting ConnectWise Dark Expand Gentlemen Global GoldDigger Guard Hive IceCube IceCube Stealer KryBit Leverage Locky Mobile malware Nexus PHP webshell Payload Payload Persistence mechanisms Phishing emails PowerShell Qilin RoundCube SNOWLIGHT STOP Satori ScreenConnect SolarWinds Spear-phishing SquareShell Trojan Unknown VBScript VIP Keylogger VShell ValleyRAT Web Shell WhatsApp YARA phishing

Indicators of Compromise (39)

Domain

android.permission ISC.AI server.adversaries attack.stealth Alibaba.com R3ADM3.TXT Microsoft.PowerShellPreview www.techradar.com

Email Address

threatinsight@infosec.exchange jpcontreras@newfield.cl security@usc.edu

Filename

dwm.exe pwsh.exe dism.exe wsl.exe dllhst3g.exe defrag.exe dashost.exe bcdedit.exe +13 more

SHA-256 Hash

a02f124c5ce4180bd130a62ee03262f399c33491de3aed36e0b15155ae4926c0

IPv4 Address

45.86.229.111 194.213.18.133 45.150.109.151

URL

http:///slw:8080 http://.sslip.io:23088 http://.sslip.io:23088/app/js/jquery.min.js

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Exploitation (11)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration M1033 Limit Software Installation +6 more

Installation (5)

M1018 User Account Management M1028 Operating System Configuration M1040 Behavior Prevention on Endpoint M1045 Code Signing M1047 Audit

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (14)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +9 more

Detection Coverage

25 strategies

5/7 stages covered

Weaponization (1)

DET0892 Detection of Domains

Exploitation (4)

DET0018 Behavior-chain, platform-aware detection... DET0086 Detect WMI Event Subscription for Persis... DET0441 Detection of Suspicious Scheduled Task C... DET0516 Behavioral Detection of Command and Scri...

Installation (9)

DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0182 Behavior-chain detection for T1135 Netwo... DET0209 Detection of Registry Query for Environm... DET0370 Recursive Enumeration of Files and Direc... +4 more

Command & Control (2)

DET0014 Detection of Data Staging Prior to Exfil... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (9)

DET0021 Behavioral Detection for Service Stop ac... DET0128 Detection Strategy for Hidden Windows DET0140 Behavioral Detection of Malicious File D... DET0168 Virtualization/Sandbox Evasion via Syste... DET0200 Indirect Command Execution – Windows uti... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

unk_masstraction

Type: Unknown Active

tracked as Copy Fail 2 Berserk Bear Energetic Bear VolatileVenom +34 more

Infrastructure 14 IOC(s)

50%

Domain

android.permission ISC.AI server.adversaries attack.stealth Alibaba.com +3

IPv4 Address

45.86.229.111 194.213.18.133 45.150.109.151

URL

http:///slw:8080 http://.sslip.io:23088 http://.sslip.io:23088/app/js/jquery.min.js

Artifacts (25)

threatinsight@infosec.exchange jpcontreras@newfield.cl security@usc.edu dwm.exe pwsh.exe dism.exe +19

Capability

50%

40 technique(s) 45 tool(s)/malware 9 CVE(s)

ABCDoor AsyncRAT Aurora Backdoor malware Bulletproof hosting ConnectWise Dark Expand +37

T1399 T1406 T1407 T1414 +11

collection

T1074

command and control

T1071

defense impairment

T1222

Victim

70%

Targeted Sectors

education manufacturing financial-services defense government telecommunications healthcare transportation utilities critical-infrastructure construction retail energy information-technology legal-services media aviation oil-gas

Targeted Countries

United States of America Canada CN US VN SG RU JP IN BR TW FR KP IL ES DE KR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.001

Capability (Malware)

ABCDoor AsyncRAT Aurora

Infrastructure

android.permission ISC.AI server.adversaries

4 Exploitation

Capability (Techniques)

T1053.005 T1059 T1129 T1546.003

Capability (Malware)

ABCDoor AsyncRAT Aurora

Infrastructure

android.permission ISC.AI server.adversaries

5 Installation

Capability (Techniques)

T1007 T1012 T1033 T1057 T1082

Capability (Malware)

ABCDoor AsyncRAT Aurora

Infrastructure

android.permission ISC.AI server.adversaries

6 Command & Control

Capability (Techniques)

T1074 T1071

Capability (Malware)

ABCDoor AsyncRAT Aurora

Infrastructure

android.permission ISC.AI server.adversaries

7 Actions on Objectives

Capability (Techniques)

T1489 T1490

Capability (Malware)

ABCDoor AsyncRAT Aurora

Infrastructure

android.permission ISC.AI server.adversaries