Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

PROMETHIUM (threat actor)

Risk

High

11 techniques 2 tools/malware 0 vulnerabilities 72 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1587.002

Code Signing Certificates resource development

T1587.003

Digital Certificates resource development

›

3 Delivery

T1189

Drive-by Compromise initial access

›

4 Exploitation

T1204.002

Malicious File execution

›

5 Installation

T1543.003

Windows Service persistence

T1547.001

Registry Run Keys / Startup Folder persistence

›

6 Command & Control

No data

›

7 Actions on Objectives

T1553.002

Code Signing defense impairment

T1036.004

Masquerade Task or Service stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1078.003

Local Accounts stealth

T1205.001

Port Knocking stealth

Stage risk: Critical High Medium None

Tools & Malware (2)

StrongPity Truvasys

Indicators of Compromise (72)

Domain

srv601.ddns.net srv602.ddns.net www.updatesync.com www.svnservices.com ftp.mynetenergy.com www.windriversupport.com www.truecrypte.org www.edicupd002.com

Filename

%temp%\lang_be29c9f3-83we

MD5 Hash

9a313b0c9f9fe6636826d57eed48f9af 08d971f5f4707ae6ea56ed2f243c38b7 f680654dd3421941cd46d6875bd501a6 c43accf1c69c3020583aa587924ac9a5 b31ea9acb9d35d9631e316a93a723ec6 2041cc8de9dab93b44434d7f748c63ad 50f77cd868f6804e9a3bd1b0745ba36c aaf90c9cf2a35fa1f56e0d0338173d2b +3 more

SHA-1 Hash

86580603f5e1d817af87e8bf3ba4dc4ea9e3069d cb5d0d1d557a1266f77357a951358c78196e97ff d75d12d250e7a36f9ef1173d630a0059b8ea5349 a77db6e89d604eabf29a6114a30345a705b05107 b32b0d52fff7c09c60bb64bc396dc7522a457399 ade19bde9716770bef84ce4414a45c0462c2eba2 e4d82ab117b86fd44c02ff3289976d15a9d9ced4 88cb78d99fa0275db8123c17a2bd3b3d58f541da +29 more

SHA-256 Hash

15ededb19ec5ab6f03db1106d2ccdeeacacdb8cd708518d065cacb1b0d7e955d 2f98ac11c78ad1b4c5c5c10a88857baf7af43acb9162e8077709db9d563bcf02 462e85023952d23b74d697911653604b40497424e7a6fe505366addae6c375f7 3ce407b441b324142e9f2cd2a5aad8eab1a73f772df0155f362d9ba9f5cb1da8 0ef8d249a2e8cb096b69c7f2cae46a073681bd43fcabc9c50eb5df454c71baea b488eea412b121d77b5d27d51888485bb640f8c61da8fa3140bd734b315d6ad2 e12031da58c0b08e8b610c3786ca2b66fcfea8ddc9ac558d08a29fd27e95a3e7 dbd8cbbaf59d19cf7566042945e36409cd090bc711e339d3f2ec652bc26d6a03 +3 more

URL

https://updserv-east-cdn3.com/p55C3xhxTuD5rkBQbB8wE99Q.php https://updserv-east-cdn3.com/s3s3sxhxTuDSrkBQb88wE99Q.php https://updserv-east-cdn3.com/kU2QLsNB6TzexJv5vGdunVXT.php https://downloading.internetdownloading.co

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (5)

M1017 User Training M1021 Restrict Web-Based Content M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software

Exploitation (3)

M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint

Installation (5)

M1018 User Account Management M1028 Operating System Configuration M1040 Behavior Prevention on Endpoint M1045 Code Signing M1047 Audit

Actions on Objectives (8)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1027 Password Policies M1032 Multi-factor Authentication +3 more

Detection Coverage

11 strategies

5/7 stages covered

Weaponization (2)

DET0833 Detection of Code Signing Certificates DET0844 Detection of Digital Certificates

Delivery (1)

DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (1)

DET0294 User Execution – Malicious File via down...

Installation (2)

DET0365 Detect Registry and Startup Folder Persi... DET0552 Detection of Windows Service Creation or...

Actions on Objectives (5)

DET0117 Detection of Masqueraded Tasks or Servic... DET0230 Detect Suspicious or Malicious Code Sign... DET0302 Port-knock → rule/daemon change → first... DET0347 Detection Strategy for Masquerading via... DET0407 Detection of Local Account Abuse for Ini...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

PROMETHIUM

Type: Unknown Active

StrongPity G0056 APT-C-41

Infrastructure 12 IOC(s)

50%

Domain

srv601.ddns.net srv602.ddns.net www.updatesync.com www.svnservices.com ftp.mynetenergy.com +3

URL

Artifacts (60)

%temp%\lang_be29c9f3-83we 9a313b0c9f9fe6636826d57eed48f9af 08d971f5f4707ae6ea56ed2f243c38b7 f680654dd3421941cd46d6875bd501a6 c43accf1c69c3020583aa587924ac9a5 b31ea9acb9d35d9631e316a93a723ec6 +54

Capability

90%

11 technique(s) 2 tool(s)/malware

StrongPity Truvasys

defense impairment

T1553.002

execution

T1204.002

initial access

T1189

persistence

T1543.003 T1547.001

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1587.002 T1587.003

Capability (Malware)

StrongPity Truvasys

Infrastructure

srv601.ddns.net srv602.ddns.net www.updatesync.com

3 Delivery

Capability (Techniques)

T1189

Capability (Malware)

StrongPity Truvasys

Infrastructure

srv601.ddns.net srv602.ddns.net www.updatesync.com

4 Exploitation

Capability (Techniques)

T1204.002

Capability (Malware)

StrongPity Truvasys

Infrastructure

srv601.ddns.net srv602.ddns.net www.updatesync.com

5 Installation

Capability (Techniques)

T1543.003 T1547.001

Capability (Malware)

StrongPity Truvasys

Infrastructure

srv601.ddns.net srv602.ddns.net www.updatesync.com