Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
APT38 (threat actor)
Risk
81
Critical
77 techniques 68 tools/malware 0 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
4
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1588
Obtain Capabilities resource development
T1588.002
Tool resource development
›
3 Delivery
3
T1189
Drive-by Compromise initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
14
T1047
Windows Management Instrumentation execution
T1053
Scheduled Task/Job execution
T1053.003
Cron execution
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.005
Visual Basic execution
T1106
Native API execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
T1569.002
Service Execution execution
T1548
Abuse Elevation Control Mechanism privilege escalation
T1548.002
Bypass User Account Control privilege escalation
›
5 Installation
14
T1110
Brute Force credential access
T1033
System Owner/User Discovery discovery
T1049
System Network Connections Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1135
Network Share Discovery discovery
T1217
Browser Information Discovery discovery
T1518
Software Discovery discovery
T1518.001
Security Software Discovery discovery
T1505
Server Software Component persistence
T1505.003
Web Shell persistence
T1543
Create or Modify System Process persistence
T1543.003
Windows Service persistence
›
6 Command & Control
7
T1005
Data from Local System collection
T1056
Input Capture collection
T1056.001
Keylogging collection
T1115
Clipboard Data collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
35
T1112
Modify Registry defense impairment
T1553
Subvert Trust Controls defense impairment
T1553.005
Mark-of-the-Web Bypass defense impairment
T1685
Disable or Modify Tools defense impairment
T1685.005
Clear Windows Event Logs defense impairment
T1686
Disable or Modify System Firewall defense impairment
T1686.002
Network Device Firewall defense impairment
T1690
Prevent Command History Logging defense impairment
T1485
Data Destruction impact
T1486
Data Encrypted for Impact impact
T1529
System Shutdown/Reboot impact
T1561
Disk Wipe impact
T1561.002
Disk Structure Wipe impact
T1565
Data Manipulation impact
T1565.001
Stored Data Manipulation impact
T1565.002
Transmitted Data Manipulation impact
T1565.003
Runtime Data Manipulation impact
T1027
Obfuscated Files or Information stealth
T1027.002
Software Packing stealth
T1036
Masquerading stealth
T1036.003
Rename Legitimate Utilities stealth
T1036.006
Space after Filename stealth
T1055
Process Injection stealth
T1070
Indicator Removal stealth
T1070.004
File Deletion stealth
T1070.006
Timestomp stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1218
System Binary Proxy Execution stealth
T1218.001
Compiled HTML File stealth
T1218.005
Mshta stealth
T1218.007
Msiexec stealth
T1218.011
Rundll32 stealth
T1480
Execution Guardrails stealth
T1480.002
Mutual Exclusion stealth
T1204.2
T1204.2
Stage risk: Critical High Medium None

Tools & Malware (68)

APT38 Akira AppleJeus BOOTWRECK MBR wiper Backdoors Beacon BlackByte BlueNoroff Carbanak CloseShave file deletion utility Cobalt Confucius Custom malware DYEPACK Dark DarkComet DarkHotel Dimens ECCENTRICBANDWAGON ELECTRICFISH FASTCash ATM exploitation tool FastCash Global Guard HOPLIGHT Hafnium Hermit Hidden Cobra KEYLIME keylogger Karma KillDisk Kimsuky Labyrinth Chollima MBR Killer Machete Medusa Microsoft Defender XDR Microsoft Teams MuddyWater NACHOCHEESE tunneler NESTEGG backdoor Naikon Nexus Octopus OilRig Open-source tools PLAY Payload Payload Poseidon QuickRide backdoor RedCurl Remote access tools RustBucket STOP SideWinder SpectralBlur TEMP.Hermit Telegram Trojan Turla Unknown Void Windows Command Shell Winnti Zero-day exploits curl phishing

Indicators of Compromise (40)

Domain
systemupdate.app com.google.chromes.updaters uv01webzoom.us com.google hw.model com.apple.identification.plist com.apple.helpers com.apple.TCC +19 more
Filename
rundll32.exe mshta.exe
SHA-256 Hash
5fbbca2d72840feb86b6ef8a1abb4fe2f225d84228a714391673be2719c73ac7 5e581f22f56883ee13358f73fabab00fcf9313a053210eb12ac18e66098346e5 2075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419 05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53 95e893e7cdde19d7d16ff5a5074d0b369abd31c1a30962656133caa8153e8d63
IPv4 Address
83.136.210.180 188.227.196.252 83.136.208.48 83.136.208.246 104.145.210.107 83.136.209.22

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

33 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more
Exploitation (16)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +11 more
Installation (15)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management M1027 Password Policies +10 more
Command & Control (3)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1057 Data Loss Prevention
Actions on Objectives (24)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions +19 more

Detection Coverage

76 strategies
6/7 stages covered

Weaponization (4)

DET0850 Detection of Obtain Capabilities DET0852 Detection of Tool DET0892 Detection of Domains DET0895 Detection of Acquire Infrastructure

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (14)

DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0290 Cross-Platform Detection of Cron Job Abu... +9 more

Installation (14)

DET0013 Detection of Local Browser Artifact Acce... DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0093 Behavioral Detection of User Discovery v... DET0182 Behavior-chain detection for T1135 Netwo... +9 more

Command & Control (7)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0102 Behavioral Detection of Input Capture Ac... DET0341 Clipboard Data Access with Anomalous Con... +2 more

Actions on Objectives (34)

DET0005 Renamed Legitimate Utility Execution wit... DET0023 Obfuscated Binary Unpacking Detection vi... DET0059 Detection Strategy for Data Manipulation DET0081 Detection of Proxy Execution via Trusted... DET0127 Behavioral Detection of Masquerading Acr... +29 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

APT38

Type: Unknown Active
NICKEL GLADSTONE BeagleBoyz Bluenoroff Stardust Chollima Sapphire Sleet +23 more
Infrastructure 33 IOC(s)
50%
Domain
systemupdate.app com.google.chromes.updaters uv01webzoom.us com.google hw.model +22
IPv4 Address
83.136.210.180 188.227.196.252 83.136.208.48 83.136.208.246 104.145.210.107 +1
Artifacts (7)
rundll32.exe mshta.exe 5fbbca2d72840feb86b6ef8a1abb4fe2f225d84228a714391673be2719c73ac7 5e581f22f56883ee13358f73fabab00fcf9313a053210eb12ac18e66098346e5 2075fd1a1362d188290910a8c55cf30c11ed5955c04af410c481410f538da419 05e1761b535537287e7b72d103a29c4453742725600f59a34a4831eafc0b8e53 +1
Capability
79%
77 technique(s) 68 tool(s)/malware
APT38 Akira AppleJeus BOOTWRECK MBR wiper Backdoors Beacon BlackByte BlueNoroff +60
T1204.2
collection
T1005 T1056 T1056.001 T1115
command and control
T1071 T1071.001 T1105
credential access
T1110
Victim
70%

Targeted Sectors

financial services financial-services government defense telecommunications healthcare education manufacturing non-profit media energy critical-infrastructure pharmaceutical aviation hospitality aerospace retail entertainment gaming information-technology think-tank transportation mining chemical legal-services nuclear oil-gas maritime construction utilities

Targeted Countries

US CN KP RU IR TW VN JP IL KR GB AU SA PK AE UA IN SG DE BY TR MX ES PL CA RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

APT38 Akira AppleJeus
3 Delivery

Capability (Techniques)

T1189 T1566 T1566.001

Capability (Malware)

APT38 Akira AppleJeus
4 Exploitation

Capability (Malware)

APT38 Akira AppleJeus
5 Installation

Capability (Malware)

APT38 Akira AppleJeus
6 Command & Control

Capability (Malware)

APT38 Akira AppleJeus
7 Actions on Objectives

Capability (Malware)

APT38 Akira AppleJeus
Leaving Threaticon

This link opens an external site that isn't part of the platform.