Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
CopyKittens (threat actor)
Risk
84
Critical
26 techniques 59 tools/malware 1 vulnerabilities 39 IOCs 6/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
2
T1588
Obtain Capabilities resource development
T1588.002
Tool resource development
›
3 Delivery
1
T1566
Phishing initial access
›
4 Exploitation
5
T1053
Scheduled Task/Job execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1204
User Execution execution
CVE CVE-2018-13379
›
5 Installation
5
T1003
OS Credential Dumping credential access
T1003.001
LSASS Memory credential access
T1187
Forced Authentication credential access
T1555
Credentials from Password Stores credential access
T1547
Boot or Logon Autostart Execution persistence
›
6 Command & Control
6
T1056
Input Capture collection
T1113
Screen Capture collection
T1560.001
Archive via Utility collection
T1560.003
Archive via Custom Method collection
T1071
Application Layer Protocol command and control
T1090
Proxy command and control
›
7 Actions on Objectives
8
T1553.002
Code Signing defense impairment
T1027
Obfuscated Files or Information stealth
T1055
Process Injection stealth
T1218
System Binary Proxy Execution stealth
T1218.011
Rundll32 stealth
T1221
Template Injection stealth
T1564
Hide Artifacts stealth
T1564.003
Hidden Window stealth
Stage risk: Critical High Medium None

Tools & Malware (59)

Agent Tesla AirVPN Azorult Buer Carbanak Cerber Cobalt Cobalt Strike Cobalt Strike Cobalt Strike - S0154 CreepyDrive CreepySnail Custom malware DROPSHOT Dharma Dharma Ransomware Empire EmpireProject Fortinet CVE‑2018‑13379 exploitation GitHub Global Google Drive Karkoff Leverage Matryoshka Matryoshka RAT Matryoshka v1 and Matryoshka v2 Meterpreter Microsoft Teams Mimikatz MuddyWater NetSrv OilRig Payload Payload Phishery PowerShell PowerShell Implant RogueRobin Rundll32 STOP SentinelOne SideTwist Silence Spear-phishing Spear-phishing emails TDTESS TDTESS TDTESS backdoor TONEDEAF TURNEDUP Trojan Unknown Vminst Windows Command Shell ZPP Zloader phishing plink

Indicators of Compromise (39)

Domain
Fortiweb.download login.microsoftonline.com credential.iqy Anyconnect.stream Bigip.stream Kaspersky.science Files.ReadWrite.All NJ.gov +14 more
Email Address
raymond.choo@fulbrightmail.org
Filename
powershell.exe rundll32.exe credential.rar
SHA-256 Hash
bf925f340920111b385078f3785f486fff1096fd0847b993892ff1ee3580fa9d d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318 cc1966eff7bed11c1faada0bb0ed0c8715404abd936cfa816cef61863a0c1dd6
IPv4 Address
107.175.150.113 45.80.149.68 94.130.88.9 45.80.149.57 135.125.147.170 45.80.149.108 172.96.188.51 185.244.129.79 +1 more
URL
http://micrrosoft.net/releasenotes.txt

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (6)
M1017 User Training M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit M1049 Antivirus/Antimalware +1 more
Exploitation (14)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management +9 more
Installation (11)
M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +6 more
Command & Control (4)
M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1047 Audit
Actions on Objectives (13)
M1013 Application Developer Guidance M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention +8 more

Detection Coverage

26 strategies
6/7 stages covered

Weaponization (2)

DET0850 Detection of Obtain Capabilities DET0852 Detection of Tool

Delivery (1)

DET0070 Detection Strategy for Phishing across p...

Exploitation (4)

DET0094 Cross-Platform Behavioral Detection of S... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... DET0516 Behavioral Detection of Command and Scri...

Installation (5)

DET0022 Detect Forced SMB/WebDAV Authentication... DET0234 Credential Dumping via Sensitive Memory... DET0274 Boot or Logon Autostart Execution Detect... DET0363 Detection of Credential Dumping from LSA... DET0430 Detect Credentials Access from Password...

Command & Control (6)

DET0102 Behavioral Detection of Input Capture Ac... DET0298 Detect Archiving via Utility (T1560.001) DET0346 Detect Screen Capture via Commands and A... DET0438 Detect Archiving via Custom Method (T156... DET0444 Detection of Command and Control Over Ap... +1 more

Actions on Objectives (8)

DET0081 Detection of Proxy Execution via Trusted... DET0128 Detection Strategy for Hidden Windows DET0230 Detect Suspicious or Malicious Code Sign... DET0378 Behavioral Detection of Obfuscated Files... DET0475 Detection Strategy for T1218.011 Rundll3... +3 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

CopyKittens

Type: Unknown Active
Slayer Kitten DarkHydrus LazyMeerkat G0052 tracked as +9 more
Infrastructure 32 IOC(s)
50%
Domain
Fortiweb.download login.microsoftonline.com credential.iqy Anyconnect.stream Bigip.stream +17
IPv4 Address
107.175.150.113 45.80.149.68 94.130.88.9 45.80.149.57 135.125.147.170 +4
URL
http://micrrosoft.net/releasenotes.txt
Artifacts (7)
raymond.choo@fulbrightmail.org powershell.exe rundll32.exe credential.rar bf925f340920111b385078f3785f486fff1096fd0847b993892ff1ee3580fa9d d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318 +1
Capability
62%
26 technique(s) 59 tool(s)/malware 1 CVE(s)
Agent Tesla AirVPN Azorult Buer Carbanak Cerber Cobalt Cobalt Strike +51
collection
T1056 T1113 T1560.001 T1560.003
command and control
T1071 T1090
credential access
T1003 T1003.001 T1187 T1555
defense impairment
T1553.002
Victim
70%

Targeted Sectors

education research government defense media financial-services manufacturing non-profit energy aviation legal-services healthcare information-technology transportation food-agriculture critical-infrastructure

Targeted Countries

US DE IL SA middle_east IR TR LB EG UA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1588 T1588.002

Capability (Malware)

Agent Tesla AirVPN Azorult
3 Delivery

Capability (Techniques)

T1566

Capability (Malware)

Agent Tesla AirVPN Azorult
4 Exploitation

Capability (Malware)

Agent Tesla AirVPN Azorult
5 Installation

Capability (Malware)

Agent Tesla AirVPN Azorult
6 Command & Control

Capability (Malware)

Agent Tesla AirVPN Azorult
Leaving Threaticon

This link opens an external site that isn't part of the platform.