Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

rootboy (threat actor)

Risk

High

4 techniques 62 tools/malware 2 vulnerabilities 28 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2023-23397

CVE CVE-2023-38831

›

5 Installation

T1003

OS Credential Dumping credential access

T1133

External Remote Services persistence

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1078

Valid Accounts stealth

Stage risk: Critical High Medium None

Tools & Malware (62)

BRAIN Babuk Backdoors Breakthrough CALENDAR Cicada3301 ClickFix Cobalt Cobalt Strike Cobalt Strike Conti DUCKTAIL Dark DragonForce Egregor Gentlemen Global Globe GoldDigger Hancitor Hive Hunters International Leverage Localtonet LockBit LockBit 3.0 Lynx Malwarebytes Matrix Mimikatz MuddyWater NSSM PLAY Payload Payload Phantom Stealer Phishing campaigns Phoenix Phoenix backdoor PingCastle Pink PowerShell Prinz Eugen ProLock Qilin Qilin Ransomware RansomHub RemotePC Rook STOP Scheduled Tasks SideWinder SilabRAT SoftPerfect Network Scanner TeamTNT Telegram TriBack Loader Trojan Unknown VietCredCare XenAllPasswordPro phishing

Indicators of Compromise (28)

Domain

WmiExec.py bleepingcomputer.com malware.news threatdown.com trojanrecords.tmstor.es Sorint.Sec Ajina.Banker SideWinder.AntiBot.Script +17 more

Email Address

pandrews@vcu.edu

SHA-256 Hash

686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4

IPv4 Address

212.80.7.74

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Installation (14)

M1015 Active Directory Configuration M1017 User Training M1021 Restrict Web-Based Content M1025 Privileged Process Integrity M1026 Privileged Account Management +9 more

Actions on Objectives (10)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +5 more

Detection Coverage

4 strategies

2/7 stages covered

Installation (2)

DET0234 Credential Dumping via Sensitive Memory... DET0354 Behavior-chain detection for T1133 Exter...

Actions on Objectives (2)

DET0348 Detection Strategy for Exfiltration Over... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

rootboy

Type: Unknown Active

avtokz citing leak-site reporting historical forum activity tracked as rudie +17 more

Infrastructure 26 IOC(s)

50%

Domain

WmiExec.py bleepingcomputer.com malware.news threatdown.com trojanrecords.tmstor.es +20

IPv4 Address

212.80.7.74

Artifacts (2)

pandrews@vcu.edu 686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4

Capability

50%

4 technique(s) 62 tool(s)/malware 2 CVE(s)

BRAIN Babuk Backdoors Breakthrough CALENDAR Cicada3301 ClickFix Cobalt +54

credential access

T1003

exfiltration

T1041

persistence

T1133

stealth

T1078

Victim

70%

Targeted Sectors

financial-services government education defense retail media aviation manufacturing healthcare telecommunications legal-services transportation critical-infrastructure information-technology construction energy mining

Targeted Countries

South Africa France United States of America Canada RU FR SG AU VN IT RO EG BR NL IN US CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

5 Installation

Capability (Techniques)

T1003 T1133

Capability (Malware)

BRAIN Babuk Backdoors

Infrastructure

WmiExec.py bleepingcomputer.com malware.news

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

BRAIN Babuk Backdoors

Infrastructure

WmiExec.py bleepingcomputer.com malware.news