Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Lazarus Group (threat actor)
Risk
85
Critical
93 techniques 33 tools/malware 0 vulnerabilities 80 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
2
T1589.002
Email Addresses reconnaissance
T1591
Gather Victim Org Information reconnaissance
›
2 Weaponization
8
T1583.001
Domains resource development
T1583.006
Web Services resource development
T1584.004
Server resource development
T1585.001
Social Media Accounts resource development
T1585.002
Email Accounts resource development
T1587.001
Malware resource development
T1588.002
Tool resource development
T1588.004
Digital Certificates resource development
›
3 Delivery
4
T1189
Drive-by Compromise initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
T1566.003
Spearphishing via Service initial access
›
4 Exploitation
8
T1047
Windows Management Instrumentation execution
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.005
Visual Basic execution
T1106
Native API execution
T1203
Exploitation for Client Execution execution
T1204.002
Malicious File execution
›
5 Installation
17
T1110.003
Password Spraying credential access
T1557.001
Name Resolution Poisoning and SMB Relay credential access
T1010
Application Window Discovery discovery
T1012
Query Registry discovery
T1016
System Network Configuration Discovery discovery
T1033
System Owner/User Discovery discovery
T1046
Network Service Discovery discovery
T1049
System Network Connections Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1124
System Time Discovery discovery
T1680
Local Storage Discovery discovery
T1098
Account Manipulation persistence
T1543.003
Windows Service persistence
T1547.001
Registry Run Keys / Startup Folder persistence
T1547.009
Shortcut Modification persistence
›
6 Command & Control
20
T1005
Data from Local System collection
T1056.001
Keylogging collection
T1074.001
Local Data Staging collection
T1560
Archive Collected Data collection
T1560.002
Archive via Library collection
T1560.003
Archive via Custom Method collection
T1001.003
Protocol or Service Impersonation command and control
T1008
Fallback Channels command and control
T1071.001
Web Protocols command and control
T1090.001
Internal Proxy command and control
T1090.002
External Proxy command and control
T1102.002
Bidirectional Communication command and control
T1104
Multi-Stage Channels command and control
T1105
Ingress Tool Transfer command and control
T1132.001
Standard Encoding command and control
T1571
Non-Standard Port command and control
T1573.001
Symmetric Cryptography command and control
T1021.001
Remote Desktop Protocol lateral movement
T1021.002
SMB/Windows Admin Shares lateral movement
T1021.004
SSH lateral movement
›
7 Actions on Objectives
34
T1553.002
Code Signing defense impairment
T1685
Disable or Modify Tools defense impairment
T1686.003
Windows Host Firewall defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol exfiltration
T1485
Data Destruction impact
T1489
Service Stop impact
T1491.001
Internal Defacement impact
T1529
System Shutdown/Reboot impact
T1561.001
Disk Content Wipe impact
T1561.002
Disk Structure Wipe impact
T1027.007
Dynamic API Resolution stealth
T1027.009
Embedded Payloads stealth
T1027.013
Encrypted/Encoded File stealth
T1036.003
Rename Legitimate Utilities stealth
T1036.004
Masquerade Task or Service stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1055.001
Dynamic-link Library Injection stealth
T1070
Indicator Removal stealth
T1070.003
Clear Command History stealth
T1070.004
File Deletion stealth
T1070.006
Timestomp stealth
T1078
Valid Accounts stealth
T1134.002
Create Process with Token stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1202
Indirect Command Execution stealth
T1218
System Binary Proxy Execution stealth
T1218.005
Mshta stealth
T1218.011
Rundll32 stealth
T1542.003
Bootkit stealth
T1564.001
Hidden Files and Directories stealth
T1574.001
DLL stealth
T1574.013
KernelCallbackTable stealth
T1620
Reflective Code Loading stealth
Stage risk: Critical High Medium None

Tools & Malware (33)

AppleJeus AuditCred BADCALL BLINDINGCAN Bankshot Cryptoistic Dacls Destover Dtrack ECCENTRICBANDWAGON FALLCHILL FallChill RAT HARDRAIN HOPLIGHT Hawup HotCroissant HtDnDownLoader KEYMARBLE MagicRAT Manuscrypt Proxysvc RATANKBA SheepRAT TAINTEDSCRIBE TYPEFRAME Tdrop Tdrop2 ThreatNeedle Troy Volgmer WannaCry Whois Wiper WolfRAT

Indicators of Compromise (80)

Domain
journalide.org glcloudservice.com sbmsa.wiki dunamistrd.com azureonlinestorage.com azureonlinecloud.com azuredeploystore.com akamaitechcloudservices.com +15 more
Filename
\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe
MD5 Hash
85d316590edfb4212049c4490db08c4b 9cc6854bc5e217104734043c89dc4ff8 9914075cc687bdc352ee136ac6579707 7fe80cee04003fed91c02e3a372f4b01 1f7897b041a812f96f1925138ea38c46 911de8d67af652a87415f8c0a30688b2 1507e7a741367745425e0530e23768e6 cb52c013f7af0219d45953bae663c9a2 +5 more
SHA-1 Hash
fa4f2e3f7c56210d1e380ec6d74a0b6dd776994b a107f1046f5224fdb3a5826fa6f940a981fe65a1 aa115e6587a535146b7493d6c02896a7d322879e 4f0d7a33d23d53c0eb8b34d102cdd660fc5323a2 da967dc59a7b61aeaeaee380b2c147c5bb1b3bc5 20d554a80d759c50d6537dd7097fed84dd258b3e 2c6c244b3858ce06a0b646ae386f65e69ae5c046 97a3698ffffdb63df79faeaf58169f9755db1f90 +9 more
SHA-256 Hash
7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 a60a61bf844bc181d4540c9fac53203250a982e7c3ad6153869f01e19cc36203 5d99efa36f34aa6b43cd81e77544961c5c8d692c96059fef92c2df2624550734 54004dfaa48ca5fa91e3304fb99559a2395301c570026450882d6aad89132a02 d45674f941be3cca2fbc1af42778043cc18cd86d95a2ecb9e6f0e212ed4c74ae 5c54932fdbb077d73c58ac41a1ad3f6ea5576b3e1f719c8b714b637c9ceb361b a917c1cc198cf36c0f2f6c24652e5c2e94e28d963b128d54f00144d216b2d118 +18 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

35 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (1)
M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more
Exploitation (14)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +9 more
Installation (15)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +10 more
Command & Control (13)
M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +8 more
Actions on Objectives (31)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +26 more

Detection Coverage

93 strategies
7/7 stages covered

Reconnaissance (2)

DET0814 Detection of Email Addresses DET0890 Detection of Gather Victim Org Informati...

Weaponization (8)

DET0835 Detection of Email Accounts DET0848 Detection of Digital Certificates DET0851 Detection of Social Media Accounts DET0852 Detection of Tool DET0872 Detection of Malware +3 more

Delivery (4)

DET0107 Detection Strategy for Spearphishing Lin... DET0115 Detection Strategy for Spearphishing via... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (8)

DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down... DET0364 Behavioral Detection Strategy for WMI Ex... +3 more

Installation (17)

DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0096 Account Manipulation Behavior Chain Dete... DET0097 Detection of Application Window Enumerat... DET0151 Behavior-chain, platform-aware detection... +12 more

Command & Control (20)

DET0027 Detection of Web Protocol-Based C2 Over... DET0035 Detect Bidirectional Web Service C2 Chan... DET0060 Detect Ingress Tool Transfers via Behavi... DET0075 Internal Proxy Behavior via Lateral Host... DET0089 Behavioral Detection of Keylogging Activ... +15 more

Actions on Objectives (34)

DET0005 Renamed Legitimate Utility Execution wit... DET0021 Behavioral Detection for Service Stop ac... DET0032 Detection Strategy for Hidden Files and... DET0081 Detection of Proxy Execution via Trusted... DET0082 Internal Website and System Content Defa... +29 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Lazarus Group

Type: Unknown Active
Labyrinth Chollima HIDDEN COBRA Guardians of Peace ZINC NICKEL ACADEMY +45 more
Infrastructure 23 IOC(s)
50%
Domain
journalide.org glcloudservice.com sbmsa.wiki dunamistrd.com azureonlinestorage.com +18
Artifacts (57)
\AppData\Local\Programs\3CXDesktopApp\app\3CXDesktopApp.exe 85d316590edfb4212049c4490db08c4b 9cc6854bc5e217104734043c89dc4ff8 9914075cc687bdc352ee136ac6579707 7fe80cee04003fed91c02e3a372f4b01 1f7897b041a812f96f1925138ea38c46 +51
Capability
90%
93 technique(s) 33 tool(s)/malware
AppleJeus AuditCred BADCALL BLINDINGCAN Bankshot Cryptoistic Dacls Destover +25
collection
T1005 T1056.001 T1074.001 T1560 +2
command and control
T1001.003 T1008 T1071.001 T1090.001 +7
credential access
T1110.003 T1557.001
defense impairment
T1553.002 T1685 T1686.003
Victim
70%

Targeted Sectors

government financial services technology

Targeted Countries

US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1589.002 T1591

Capability (Malware)

AppleJeus AuditCred BADCALL
2 Weaponization

Capability (Malware)

AppleJeus AuditCred BADCALL
3 Delivery

Capability (Malware)

AppleJeus AuditCred BADCALL
4 Exploitation

Capability (Malware)

AppleJeus AuditCred BADCALL
5 Installation

Capability (Malware)

AppleJeus AuditCred BADCALL
6 Command & Control

Capability (Malware)

AppleJeus AuditCred BADCALL
7 Actions on Objectives

Capability (Malware)

AppleJeus AuditCred BADCALL
Leaving Threaticon

This link opens an external site that isn't part of the platform.