Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

ta458 (threat actor)

Risk

Critical

38 techniques 55 tools/malware 10 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.001

Domains resource development

T1583.002

DNS Server resource development

T1587.001

Malware resource development

›

3 Delivery

No data

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2017-11882

CVE CVE-2023-43770

CVE CVE-2024-42009

CVE CVE-2024-42900

CVE CVE-2025-27915

CVE CVE-2025-3929

CVE CVE-2025-49113

CVE CVE-2025-66376

CVE CVE-2026-0257

CVE CVE-2026-8496

›

5 Installation

T1003

OS Credential Dumping credential access

T1018

Remote System Discovery discovery

T1046

Network Service Discovery discovery

T1087.002

Domain Account discovery

T1136.002

Domain Account persistence

T1505.003

Web Shell persistence

›

6 Command & Control

T1074

Data Staged collection

T1114

Email Collection collection

T1560.001

Archive via Utility collection

T1071.004

DNS command and control

T1132.001

Standard Encoding command and control

T1573.001

Symmetric Cryptography command and control

T1021.006

Windows Remote Management lateral movement

T1570

Lateral Tool Transfer lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1556.008

Network Provider DLL defense impairment

T1030

Data Transfer Size Limits exfiltration

T1041

Exfiltration Over C2 Channel exfiltration

T1027.009

Embedded Payloads stealth

T1036.005

Match Legitimate Resource Name or Location stealth

T1036.008

Masquerade File Type stealth

T1070.004

File Deletion stealth

T1070.006

Timestomp stealth

T1078.002

Domain Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1564.002

Hidden Users stealth

T1069?

T1101?

T1125?

T127?

Stage risk: Critical High Medium None

Tools & Malware (55)

Agent Raccoon Agent Racoon Backdoors Beacon CVE-2017-11882 Chaos Cotx Crypt_GPG_Engine Custom malware DWAgent Expand GitHub Global Kimsuky Ladon Leverage Logtu MATCHBOIL.V2 Mimikatz Mimilite NBTscan NPPSPY Nexus Ntospy PEBBLEDASH Payload Payload Phishing emails PortDoor PowerShell PowerShell scripts Process Hollowing Proton Qilin Raccoon RoundCube STOP Satori ShadowPad Sofacy SpyPress Trojan Unknown Void WildFire YARA Zebrocy ZimReaper curl ipconfig malware distribution nccTrojan netstat phishing wmic

Indicators of Compromise (40)

Domain

list.js.php ntds.dit Dr.Web 163.com cyfar.ca Backdoor.Win32.CotSam OEMPRINT.CAT ace.cab +7 more

Email Address

threatinsight@infosec.exchange ics-cert@kaspersky.com

Filename

update.exe install.bat ace.exe ntoskrnl.dll wmic.vbs ebat.bat ntos.dll applaunch.exe +4 more

MD5 Hash

b855dfde7f778f99a3724802715a0baa

SHA-256 Hash

bcd2bdea2bfecd09e258b8777e3825c4a1d98af220e7b045ee7b6c30bf19d6df 4351911f266eea8e62da380151a54d5c3fbbc7b08502f28d3224f689f55bffba 3a2d0e5e4bfd6db9c45f094a638d1f1b9d07110b9f6eb8874b75d968401ad69c 98df604ecc57f884a2e6ce3266a0013ad64455cac48442c2312cfa4765007aaf 1517b3caa495f6c4e832df9c75fc94667e3c233773f7fa4e056d5e30e5ead760 60db9abae75cd8ccc49dd7ea5feb41677566dcd442f12ebc5745ffd2810fb874 b1f5beb1175fc5c7d1806a2f0d900eb124c54f0286c5c52b66eea7a6633adb1d dee7321085737da53646b1f2d58838ece97c81e3f2319a29f7629d62395dbfd1 +2 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

28 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Exploitation (13)

M1018 User Account Management M1019 Threat Intelligence Program M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention +8 more

Installation (14)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1025 Privileged Process Integrity M1026 Privileged Account Management +9 more

Command & Control (9)

M1026 Privileged Account Management M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic +4 more

Actions on Objectives (15)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +10 more

Detection Coverage

34 strategies

5/7 stages covered

Weaponization (3)

DET0862 Detection of DNS Server DET0872 Detection of Malware DET0892 Detection of Domains

Exploitation (5)

DET0202 Behavioral Detection of Windows Command... DET0364 Behavioral Detection Strategy for WMI Ex... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0514 Detection Strategy for Exploitation for...

Installation (6)

DET0003 T1136.002 Detection Strategy - Domain Ac... DET0129 Domain Account Enumeration Across Platfo... DET0234 Credential Dumping via Sensitive Memory... DET0376 Behavioral Detection Strategy for Networ... DET0394 Web Shell Detection via Server Behavior... +1 more

Command & Control (8)

DET0014 Detection of Data Staging Prior to Exfil... DET0124 Behavior-chain detection for T1132.001 D... DET0143 Detection Strategy for Encrypted Channel... DET0183 Detection Strategy for Lateral Tool Tran... DET0298 Detect Archiving via Utility (T1560.001) +3 more

Actions on Objectives (12)

DET0140 Behavioral Detection of Malicious File D... DET0210 Abuse of Domain Accounts DET0213 Detection Strategy for Data Transfer Siz... DET0214 Detection Strategy for Embedded Payloads DET0226 Detection Strategy for Masquerading via... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

ta458

Type: Unknown Active

tracked as Taxol

Infrastructure 15 IOC(s)

50%

Domain

list.js.php ntds.dit Dr.Web 163.com cyfar.ca +10

Artifacts (25)

threatinsight@infosec.exchange ics-cert@kaspersky.com update.exe install.bat ace.exe ntoskrnl.dll +19

Capability

50%

38 technique(s) 55 tool(s)/malware 10 CVE(s)

Agent Raccoon Agent Racoon Backdoors Beacon CVE-2017-11882 Chaos Cotx Crypt_GPG_Engine +47

T1069? T1101? T1125? T127?

collection

T1074 T1114 T1560.001

command and control

T1071.004 T1132.001 T1573.001

credential access

T1003

Victim

70%

Targeted Sectors

government defense communications telecommunications education utilities critical-infrastructure chemical nuclear energy manufacturing financial-services non-profit information-technology

Targeted Countries

Albania Greece Moldova, Republic of Ukraine US RU UA CN IR RO BR BY FR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.001 T1583.002 T1587.001

Capability (Malware)

Agent Raccoon Agent Racoon Backdoors

Infrastructure

list.js.php ntds.dit Dr.Web

4 Exploitation

Capability (Techniques)

T1047 T1053.005 T1059.001 T1059.003 T1068

Capability (Malware)

Agent Raccoon Agent Racoon Backdoors

Infrastructure

list.js.php ntds.dit Dr.Web

5 Installation

Capability (Techniques)

T1003 T1018 T1046 T1087.002 T1136.002

Capability (Malware)

Agent Raccoon Agent Racoon Backdoors

Infrastructure

list.js.php ntds.dit Dr.Web

6 Command & Control

Capability (Techniques)

T1074 T1114 T1560.001 T1071.004 T1132.001

Capability (Malware)

Agent Raccoon Agent Racoon Backdoors

Infrastructure

list.js.php ntds.dit Dr.Web

7 Actions on Objectives

Capability (Techniques)

T1030 T1041

Capability (Malware)

Agent Raccoon Agent Racoon Backdoors

Infrastructure

list.js.php ntds.dit Dr.Web