Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Wekby (threat actor)
Risk
84
Critical
28 techniques 49 tools/malware 4 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
No data
›
4 Exploitation
19
T1053
Scheduled Task/Job execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.002
AppleScript execution
T1059.003
Windows Command Shell execution
T1059.004
Unix Shell execution
T1059.005
Visual Basic execution
T1059.006
Python execution
T1059.007
JavaScript execution
T1059.008
Network Device CLI execution
T1059.009
Cloud API execution
T1059.010
AutoHotKey & AutoIT execution
T1059.011
Lua execution
T1059.012
Hypervisor CLI execution
T1059.013
Container CLI/API execution
CVE CVE-2017-11882
CVE CVE-2017-8759
CVE CVE-2025-49704
CVE CVE-2025-49706
›
5 Installation
5
T1016
System Network Configuration Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1133
External Remote Services persistence
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
5
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1071.004
DNS command and control
T1105
Ingress Tool Transfer command and control
T1132.001
Standard Encoding command and control
›
7 Actions on Objectives
3
T1027
Obfuscated Files or Information stealth
T1070
Indicator Removal stealth
T1078
Valid Accounts stealth
Stage risk: Critical High Medium None

Tools & Malware (49)

Babuk Bazar Beacon Bisonal Black Basta China Chopper / Ckife Webshells Clayslide Cobalt Cobalt Strike Conti Dark Emissary GCat GitHub Global GreyEngergy Mini as their 1st-stage implant HTTPBrowser Havoc Helminth InvisiMole KONNI Kimsuky Latrodectus LazyCat Leverage LockBit LockBit 2.0 Medusa Medusa Ransomware OilRig OlympicDestroyer PLAY Payload Pikabot Pisloader PlugX PowerShell QakBot Ryuk TokenControl Trojan Tsunami Turla VBScript WildFire Windows Command Shell hcdLoader phishing reGeorge

Indicators of Compromise (40)

Domain
mydomain1609.com Basketball-Reference.com Trojan.Karagany HHS.gov wintrust.hlm cisa.gov intranetwabcam.com BOOTSECT.BAK +11 more
Filename
set.bat cmd.exe at.exe update.vbs lsm.exe wmiexec.vbs Managment.lnk adbmanager.exe +10 more
IPv4 Address
5.39.112.87 35.35.35.35
URL
http://go0gIe.com/sysupdate.aspx?req=

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

24 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Exploitation (12)
M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +7 more
Installation (5)
M1021 Restrict Web-Based Content M1030 Network Segmentation M1032 Multi-factor Authentication M1035 Limit Access to Resource Over Network M1042 Disable or Remove Feature or Program
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (14)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +9 more

Detection Coverage

28 strategies
4/7 stages covered

Exploitation (15)

DET0063 Cross-Platform Behavioral Detection of P... DET0076 Behavioral Detection of Visual Basic Exe... DET0078 Behavioral Detection of Malicious Cloud... DET0083 Container CLI and API Abuse via Docker/K... DET0094 Cross-Platform Behavioral Detection of S... +10 more

Installation (5)

DET0195 Behavioral Detection of System Network C... DET0274 Boot or Logon Autostart Execution Detect... DET0354 Behavior-chain detection for T1133 Exter... DET0370 Recursive Enumeration of Files and Direc... DET0525 System Discovery via Native and Remote U...

Command & Control (5)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0124 Behavior-chain detection for T1132.001 D... DET0400 Behavioral Detection of DNS Tunneling an... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (3)

DET0184 Behavioral Detection of Indicator Remova... DET0378 Behavioral Detection of Obfuscated Files... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
70%

Wekby

Type: Nation-State Active
Dynamite Panda TG-0416 APT18 TA428 Colourful Panda +9 more
Infrastructure 22 IOC(s)
50%
Domain
mydomain1609.com Basketball-Reference.com Trojan.Karagany HHS.gov wintrust.hlm +14
IPv4 Address
5.39.112.87 35.35.35.35
URL
http://go0gIe.com/sysupdate.aspx?req=
Artifacts (18)
set.bat cmd.exe at.exe update.vbs lsm.exe wmiexec.vbs +12
Capability
54%
28 technique(s) 49 tool(s)/malware 4 CVE(s)
Babuk Bazar Beacon Bisonal Black Basta China Chopper / Ckife Webshells Clayslide Cobalt +41
command and control
T1071 T1071.001 T1071.004 T1105 +1
discovery
T1016 T1082 T1083
execution
T1053 T1059 T1059.001 T1059.002 +11
persistence
T1133 T1547
Victim
70%

Targeted Sectors

defense healthcare technology telecommunications aerospace & defense education transportation government financial-services non-profit aerospace energy pharmaceutical critical-infrastructure manufacturing media maritime think-tank information-technology construction retail utilities oil-gas

Targeted Countries

US CN UA RU KR IN SA PL TW KP IL MX VN IR JP CA AZ BY PK GB europe

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Nation-State

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

4 Exploitation

Capability (Malware)

Babuk Bazar Beacon
5 Installation

Capability (Malware)

Babuk Bazar Beacon
6 Command & Control

Capability (Malware)

Babuk Bazar Beacon
Leaving Threaticon

This link opens an external site that isn't part of the platform.