Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
TEMP.Hermit (threat actor)
Risk
79
Critical
20 techniques 54 tools/malware 1 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
3
T1189
Drive-by Compromise initial access
T1195
Supply Chain Compromise initial access
T1566
Phishing initial access
›
4 Exploitation
4
T1203
Exploitation for Client Execution execution
T1559
Inter-Process Communication execution
T1546
Event Triggered Execution privilege escalation
CVE CVE-2022-0609
›
5 Installation
2
T1217
Browser Information Discovery discovery
T1543
Create or Modify System Process persistence
›
6 Command & Control
3
T1071
Application Layer Protocol command and control
T1102
Web Service command and control
T1573
Encrypted Channel command and control
›
7 Actions on Objectives
9
T1553
Subvert Trust Controls defense impairment
T1657
Financial Theft impact
T1027
Obfuscated Files or Information stealth
T1055
Process Injection stealth
T1078
Valid Accounts stealth
T1218
System Binary Proxy Execution stealth
T1574
Hijack Execution Flow stealth
T1620
Reflective Code Loading stealth
T1678
Delay Execution stealth
Stage risk: Critical High Medium None

Tools & Malware (54)

APT38 Akira AppleJeus Backdoors BlackByte BlueNoroff Bureau 325 Carbanak Citrine Sleet Cobalt CollectionRAT ComeBacker Confucius Custom malware Dark DarkHotel Destructive Malware FULLHOUSE GitHub Gleaming Pisces Global HLOADER Hermit Hidden Cobra KANDYKORN Kimsuky Labyrinth Chollima Machete Medusa Moonstone Sleet Naikon Nexus OdicLoader PEACHPIT PLAY POOLRAT Payload Payload Phishing emails PondRAT Remote access tools RustBucket SUGARLOADER Spear-phishing Spear-phishing emails TEMP.Hermit Trojan Unknown UpdateAgent VEILEDSIGNAL Void Volgmer Winnti phishing

Indicators of Compromise (39)

Domain
azuredeploystore.com msstorageazure.com msstorageboxes.com officeaddons.com officestoragebox.com pbxcloudeservices.com sourceslabs.com visualstudiofactory.com +12 more
SHA-256 Hash
c9a7b42c7b29ca948160f95f017e9e9ae781f3b981ecf6edbac943e52c63ffc8 3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940 c7f4aa77be7f7afe9d0665d3e705dbf7794bc479bb9c44488c7bf4169f8d14fe 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1 689cfaa9319f3f7529a31472ecf6b2e0ca6891b736de009e0b6c2ebac958cc94 c6a48365c3db9761bd60981bdcdd87aced23d8e60067caa30fee501bf4b47b84 a03d13c9825e150810e6e6aaf053d71ec5a53b86581414dd982a74d4a8bc5475 927b3564c1cf884d2a05e1d7bd24362ce8563a1e9b85be776190ab7f8af192f6 +10 more
IPv4 Address
23.254.226.90

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

30 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (14)
M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +9 more
Exploitation (8)
M1013 Application Developer Guidance M1026 Privileged Account Management M1040 Behavior Prevention on Endpoint M1042 Disable or Remove Feature or Program M1048 Application Isolation and Sandboxing +3 more
Installation (9)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration M1033 Limit Software Installation +4 more
Command & Control (4)
M1020 SSL/TLS Inspection M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (23)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +18 more

Detection Coverage

20 strategies
5/7 stages covered

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0537 Behavioral detection for Supply Chain Co...

Exploitation (3)

DET0010 Behavioral Detection of Event Triggered... DET0287 Exploitation for Client Execution – cros... DET0493 Detect Abuse of Inter-Process Communicat...

Installation (2)

DET0013 Detection of Local Browser Artifact Acce... DET0571 Detection of System Process Creation or...

Command & Control (3)

DET0273 Detection Strategy for Encrypted Channel... DET0425 Suspicious Use of Web Services for C2 DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (9)

DET0081 Detection of Proxy Execution via Trusted... DET0218 Detection Strategy for Hijack Execution... DET0300 Detection Strategy for Reflective Code L... DET0372 Multi-Platform Detection Strategy for T1... DET0378 Behavioral Detection of Obfuscated Files... +4 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
50%

TEMP.Hermit

Type: Unknown Active
APT38 Diamond Sleet UNC4034 0mid16B Lazarus Group +34 more
Infrastructure 21 IOC(s)
50%
Domain
azuredeploystore.com msstorageazure.com msstorageboxes.com officeaddons.com officestoragebox.com +15
IPv4 Address
23.254.226.90
Artifacts (18)
c9a7b42c7b29ca948160f95f017e9e9ae781f3b981ecf6edbac943e52c63ffc8 3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940 c7f4aa77be7f7afe9d0665d3e705dbf7794bc479bb9c44488c7bf4169f8d14fe 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1 689cfaa9319f3f7529a31472ecf6b2e0ca6891b736de009e0b6c2ebac958cc94 c6a48365c3db9761bd60981bdcdd87aced23d8e60067caa30fee501bf4b47b84 +12
Capability
51%
20 technique(s) 54 tool(s)/malware 1 CVE(s)
APT38 Akira AppleJeus Backdoors BlackByte BlueNoroff Bureau 325 Carbanak +46
command and control
T1071 T1102 T1573
defense impairment
T1553
discovery
T1217
execution
T1203 T1559
Victim
70%

Targeted Sectors

aerospace & defense financial-services government defense telecommunications healthcare education manufacturing media energy critical-infrastructure pharmaceutical non-profit aerospace aviation hospitality nuclear entertainment think-tank retail information-technology transportation mining chemical gaming legal-services oil-gas maritime construction utilities

Targeted Countries

KP US CN JP RU KR IR TW VN IL GB AU SA PK AE UA IN SG DE BY TR MX ES PL CA RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1195 T1566

Capability (Malware)

APT38 Akira AppleJeus
4 Exploitation

Capability (Techniques)

T1203 T1559 T1546

Capability (Malware)

APT38 Akira AppleJeus
5 Installation

Capability (Techniques)

T1217 T1543

Capability (Malware)

APT38 Akira AppleJeus
6 Command & Control

Capability (Techniques)

T1071 T1102 T1573

Capability (Malware)

APT38 Akira AppleJeus
7 Actions on Objectives

Capability (Techniques)

T1657

Capability (Malware)

APT38 Akira AppleJeus
Leaving Threaticon

This link opens an external site that isn't part of the platform.