Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

APT-C-23 (threat actor)

Risk

Critical

48 techniques 59 tools/malware 1 vulnerabilities 39 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583

Acquire Infrastructure resource development

T1586

Compromise Accounts resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

T1566.003

Spearphishing via Service initial access

›

4 Exploitation

T1053

Scheduled Task/Job execution

T1059

Command and Scripting Interpreter execution

CVE CVE-2022-47966

›

5 Installation

T1110

Brute Force credential access

›

6 Command & Control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1036

Masquerading stealth

T1398

T1402

T1406

T1407

T1412

T1414

T1417.001

T1418

T1418.001

T1420

T1422

T1426

T1429

T1430

T1432

T1433

T1437

T1438

T1444

T1447

T1476

T1481.003

T1508

T1512

T1513

T1517

T1532

T1533

T1544

T1575

T1624.001

T1636.002

T1636.003

T1636.004

T1646

T1655

T1660

Stage risk: Critical High Medium None

Tools & Malware (59)

AridSpy AsyncRAT Barb(ie) Downloader BarbWire BarbWire Backdoor Beacon BlackSuit Caminho Confucius Crisis DCRAT DONOT Desert Scorpion Dummy FOFA FrozenCell GitHub Global GnatSpy Google Drive Grizzly Steppe HeartCrypt Imminent Monitor Jackal KASPERAGENT and MICROPSIA KasperAgent LapizaChat Micropsia Mobile malware MuddyWater Nexus NortirChat PLAY Payload Payload Phenakite PowerShell Process Hollowing PureCrypter ReblyChat Remcos Royal Scheduled Tasks Spear-phishing SpyC23 SpyC23.A StrifeWater StrifeWater RAT Telegram Trojan Unknown VAMP VICEROY WhatsApp Windows Command Shell myScript.js njRAT phishing vamp

Indicators of Compromise (39)

Domain

adbloker.dat wanda-bell.website Mallory.ai fausto-barb.website frances-thomas.com Spy.AridSpy palcivilreg.com prefLog.dex +6 more

Email Address

threatintel@eset.com

Filename

Security.exe Notifications.exe update.apk LapizaChat.apk myScript.js NortirChat.apk reblychat.apk data.zip +4 more

SHA-1 Hash

4dcdb7095da34b3cef73ad721d27002c5f65f47b ff1c877db4d0b6a37f4ba5d7b4bd4b3b980eddef ad9d280a97ee3a52314c84a6ec82ef25a005467d

SHA-256 Hash

ebe09a6ef73a572f7a19d2e1eccd8f5d1895ae2730e67a060d008a2703ab3ec2 e58b6be462d9c32a140485069ea5ab6e1f68bfa5ca639338b2361447076ca046 1391fc71b88b027fc29536dbebf29859aae1a7a8fc3121e02ae69a0909c147a9 b59091e84ab7d612a3c19a87802e834afb8893f2d5a957727e2ae7aa7b5fdb50 b9f967e263dad9b08c19b5f2933fc71047d194d0c495058a0a54c8de11ce5d60 b1c604ca3cf3a17de9e182722a20e5381b255203d7a80ab7c18a6cf9439551d1 adaa228e7b90ea2649da319f6651b140e93273d016267240c9aea7c0fea2e0bc c4fdbfd6608748d7f675a83f392cd923e86a6d491395a611a3d651c3385708b8

URL

http://media-storage.site/09vy09JC053w15ik21Sw04”

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (12)

M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +7 more

Installation (4)

M1018 User Account Management M1027 Password Policies M1032 Multi-factor Authentication M1036 Account Use Policies

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (10)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1038 Execution Prevention +5 more

Detection Coverage

11 strategies

6/7 stages covered

Weaponization (2)

DET0876 Detection of Compromise Accounts DET0895 Detection of Acquire Infrastructure

Delivery (3)

DET0107 Detection Strategy for Spearphishing Lin... DET0115 Detection Strategy for Spearphishing via... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0094 Cross-Platform Behavioral Detection of S... DET0516 Behavioral Detection of Command and Scri...

Installation (1)

DET0463 Brute Force Authentication Failures with...

Command & Control (1)

DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (2)

DET0127 Behavioral Detection of Masquerading Acr... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

APT-C-23

Type: Unknown Active

Mantis Arid Viper Desert Falcon TAG-63 Grey Karkadann +20 more

Infrastructure 15 IOC(s)

50%

Domain

adbloker.dat wanda-bell.website Mallory.ai fausto-barb.website frances-thomas.com +9

URL

http://media-storage.site/09vy09JC053w15ik21Sw04”

Artifacts (24)

threatintel@eset.com Security.exe Notifications.exe update.apk LapizaChat.apk myScript.js +18

Capability

51%

48 technique(s) 59 tool(s)/malware 1 CVE(s)

AridSpy AsyncRAT Barb(ie) Downloader BarbWire BarbWire Backdoor Beacon BlackSuit Caminho +51

T1398 T1402 T1406 T1407 +33

command and control

T1105

credential access

T1110

execution

T1053 T1059

Victim

70%

Targeted Sectors

government defense energy financial-services education telecommunications transportation media non-profit legal-services healthcare critical-infrastructure manufacturing

Targeted Countries

IL CN EG VN KR RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583 T1586

Capability (Malware)

AridSpy AsyncRAT Barb(ie) Downloader

Infrastructure

adbloker.dat wanda-bell.website Mallory.ai

3 Delivery

Capability (Techniques)

T1566.001 T1566.002 T1566.003

Capability (Malware)

AridSpy AsyncRAT Barb(ie) Downloader

Infrastructure

adbloker.dat wanda-bell.website Mallory.ai

4 Exploitation

Capability (Techniques)

T1053 T1059

Capability (Malware)

AridSpy AsyncRAT Barb(ie) Downloader

Infrastructure

adbloker.dat wanda-bell.website Mallory.ai

5 Installation

Capability (Techniques)

T1110

Capability (Malware)

AridSpy AsyncRAT Barb(ie) Downloader

Infrastructure

adbloker.dat wanda-bell.website Mallory.ai

6 Command & Control

Capability (Techniques)

T1105

Capability (Malware)

AridSpy AsyncRAT Barb(ie) Downloader

Infrastructure

adbloker.dat wanda-bell.website Mallory.ai

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

AridSpy AsyncRAT Barb(ie) Downloader

Infrastructure

adbloker.dat wanda-bell.website Mallory.ai