Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
tag-195 (threat actor)
Risk
91
Critical
32 techniques 48 tools/malware 5 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1189
Drive-by Compromise initial access
›
4 Exploitation
9
T1047
Windows Management Instrumentation execution
T1059.003
Windows Command Shell execution
T1204.002
Malicious File execution
T1204.004
Malicious Copy and Paste execution
CVE CVE-2017-11882
CVE CVE-2022-42475
CVE CVE-2024-3400
CVE CVE-2025-0282
CVE CVE-2025-0283
›
5 Installation
13
T1528
Steal Application Access Token credential access
T1555
Credentials from Password Stores credential access
T1016
System Network Configuration Discovery discovery
T1016.001
Internet Connection Discovery discovery
T1016.002
Wi-Fi Discovery discovery
T1018
Remote System Discovery discovery
T1033
System Owner/User Discovery discovery
T1046
Network Service Discovery discovery
T1049
System Network Connections Discovery discovery
T1082
System Information Discovery discovery
T1087.002
Domain Account discovery
T1135
Network Share Discovery discovery
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
8
T1056.001
Keylogging collection
T1113
Screen Capture collection
T1115
Clipboard Data collection
T1123
Audio Capture collection
T1071.001
Web Protocols command and control
T1090
Proxy command and control
T1105
Ingress Tool Transfer command and control
T1021
Remote Services lateral movement
›
7 Actions on Objectives
6
T1041
Exfiltration Over C2 Channel exfiltration
T1027
Obfuscated Files or Information stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1218.010
Regsvr32 stealth
T1562.004
T1562.004
T9000
T9000
Stage risk: Critical High Medium None

Tools & Malware (48)

Agent Tesla Azorult Backdoors Bazar Bisonal ChonkyChicken ChromEggscalator ClickFix Cobalt Cobalt Strike Cyclops Cyclops Blink Dtrack FunnyDream Global Havoc Hydraq IcedID InvisiMole KONNI Kimsuky LODEINFO Latrodectus Modular ChonkyChicken MuddyWater NETWIRE Octopus OilRig Payload Payload PlugX PowerShell QakBot RATANKBA Ryuk Sliver TinyEgg TrickBot Trojan Turla Winnti Zebrocy certutil curl ifconfig ipconfig phishing route

Indicators of Compromise (40)

Domain
xtrafftrck.net screenly.cam ahdaratlegalservices.com paysolutions.ink aurekh.com thessa.trackgrid.net lg.txt macOS.OSAMiner +9 more
Filename
updater.ocx ipconfig.exe cscript.exe chromelevator.ocx koki.ocx powershell.exe cmd.exe Node.js +6 more
SHA-256 Hash
5d585f2b24503a96011bbe928f42b1b663946e822b309f8496573c66b5ee834c b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45 7ee371ff1a13a3bbd26c925a9beedb1aa0d0c03fe6f63d3803a3a55aaccd0a5b 33a12c2328db22429c4a515400a57ffeaf7aec48a2a3c299ab6f1ce2d2b0e87d
IPv4 Address
64.176.69.196 70.34.205.43 108.61.209.100 65.20.102.161 65.20.105.177

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (5)
M1017 User Training M1021 Restrict Web-Based Content M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software
Exploitation (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention +2 more
Installation (11)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies +6 more
Command & Control (9)
M1018 User Account Management M1020 SSL/TLS Inspection M1027 Password Policies M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +4 more
Actions on Objectives (7)
M1017 User Training M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1047 Audit M1049 Antivirus/Antimalware +2 more

Detection Coverage

30 strategies
5/7 stages covered

Delivery (1)

DET0176 Drive-by Compromise — Behavior-based, Mu...

Exploitation (4)

DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0340 User Execution – Malicious Copy & Paste... DET0364 Behavioral Detection Strategy for WMI Ex...

Installation (13)

DET0093 Behavioral Detection of User Discovery v... DET0129 Domain Account Enumeration Across Platfo... DET0182 Behavior-chain detection for T1135 Netwo... DET0195 Behavioral Detection of System Network C... DET0320 Detection of System Network Connections... +8 more

Command & Control (8)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0221 Behavioral Detection Strategy for T1123... DET0269 Behavioral Detection Strategy for Remote... +3 more

Actions on Objectives (4)

DET0275 Detect Adversary Deobfuscation or Decodi... DET0282 Detection Strategy for System Binary Pro... DET0348 Detection Strategy for Exfiltration Over... DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

tag-195

Type: Unknown Active
Golden Chickens Venom Spider tracked as hyp3rlinx ApparitionSec +9 more
Infrastructure 22 IOC(s)
50%
Domain
xtrafftrck.net screenly.cam ahdaratlegalservices.com paysolutions.ink aurekh.com +12
IPv4 Address
64.176.69.196 70.34.205.43 108.61.209.100 65.20.102.161 65.20.105.177
Artifacts (18)
updater.ocx ipconfig.exe cscript.exe chromelevator.ocx koki.ocx powershell.exe +12
Capability
50%
32 technique(s) 48 tool(s)/malware 5 CVE(s)
Agent Tesla Azorult Backdoors Bazar Bisonal ChonkyChicken ChromEggscalator ClickFix +40
T1562.004 T9000
collection
T1056.001 T1113 T1115 T1123
command and control
T1071.001 T1090 T1105
credential access
T1528 T1555
Victim
70%

Targeted Sectors

government defense energy financial-services telecommunications critical-infrastructure healthcare non-profit maritime think-tank transportation media aviation information-technology education manufacturing aerospace food-agriculture construction utilities retail mining hospitality

Targeted Countries

CN RU UA TW PL IN KR US KP BY PK MX IR AZ AE SA ES VN LB AU JP CA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189

Capability (Malware)

Agent Tesla Azorult Backdoors
4 Exploitation

Capability (Malware)

Agent Tesla Azorult Backdoors
5 Installation

Capability (Malware)

Agent Tesla Azorult Backdoors
6 Command & Control

Capability (Malware)

Agent Tesla Azorult Backdoors
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Agent Tesla Azorult Backdoors
Leaving Threaticon

This link opens an external site that isn't part of the platform.