Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

larva-24009 (threat actor)

Risk

High

11 techniques 46 tools/malware 2 vulnerabilities 36 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

›

4 Exploitation

T1053.005

Scheduled Task execution

T1059.001

PowerShell execution

CVE CVE-2017-11882

CVE CVE-2024-38178

›

5 Installation

T1136.001

Local Account persistence

›

6 Command & Control

T1056.001

Keylogging collection

T1113

Screen Capture collection

T1105

Ingress Tool Transfer command and control

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1027

Obfuscated Files or Information stealth

T1076

T1223

Stage risk: Critical High Medium None

Tools & Malware (46)

Astaroth Backdoors Batch script(s) CVE-2017-11882 ClickFix Custom PowerShell scripts DCRAT Dark Divergent GitHub Global LNK files Lynx MSBuild Malicious ZIP files NirSoft tools Notifier malware PLAY Payload Payload Phishing campaigns Phishing emails Phishing-as-a-Service kits PowerShell PowerShell backdoor PowerShell commands PowerShell scripts Quasar Quasar RAT QuasarRAT Ransomware payload Remcos Remcos RAT Setup.exe Social engineering tactics Solar Telegram Trojan UltraVNC Unknown XRat YARA defendnot msbuild.exe njRAT phishing

Indicators of Compromise (36)

Domain

pozeny.shop log.Log randPermDic.txt index.Php new-upload.Php get-command.Php blogasec.ahnlab.com aonexa.shop +6 more

Filename

ChromePass.exe MSBuild.exe Setup.exe Docx.Lnk LastActivityView.exe WebBrowserBookmarksView.exe netpass.exe Setup.zip +1 more

MD5 Hash

10b40185106eb3760cb71c46117aa0bf 444fb3592cd1848660259a913684795b 2973fda8d0d0fa0200a05889fce85df6 1500fefcdda275b70e2051a3e7d9f794 094bc518d9adb0f72eee6c727ec1cef7 154c1bd26ca2844a1147a8c7209db415 1971d337664acbe3fc34a3846812aa54 271b1166f4020e1cf875b9882dffc407 +2 more

IPv4 Address

217.77.6.50 209.145.59.89 157.173.104.153

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

15 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (8)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1038 Execution Prevention M1042 Disable or Remove Feature or Program +3 more

Installation (2)

M1026 Privileged Account Management M1032 Multi-factor Authentication

Command & Control (5)

M1018 User Account Management M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic M1042 Disable or Remove Feature or Program

Actions on Objectives (4)

M1017 User Training M1040 Behavior Prevention on Endpoint M1047 Audit M1049 Antivirus/Antimalware

Detection Coverage

9 strategies

5/7 stages covered

Delivery (1)

DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (1)

DET0447 T1136.001 Detection Strategy - Local Acc...

Command & Control (4)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0346 Detect Screen Capture via Commands and A... DET0596 Behavioral Detection of Remote SSH Login...

Actions on Objectives (1)

DET0378 Behavioral Detection of Obfuscated Files...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

larva-24009

Type: Unknown Active

tracked as Thoreau's flower moth solar insolation glandular trichomes

Infrastructure 17 IOC(s)

50%

Domain

pozeny.shop log.Log randPermDic.txt index.Php new-upload.Php +9

IPv4 Address

217.77.6.50 209.145.59.89 157.173.104.153

Artifacts (19)

ChromePass.exe MSBuild.exe Setup.exe Docx.Lnk LastActivityView.exe WebBrowserBookmarksView.exe +13

Capability

50%

11 technique(s) 46 tool(s)/malware 2 CVE(s)

Astaroth Backdoors Batch script(s) CVE-2017-11882 ClickFix Custom PowerShell scripts DCRAT Dark +38

T1076 T1223

collection

T1056.001 T1113

command and control

T1105

execution

T1053.005 T1059.001

Victim

70%

Targeted Sectors

healthcare maritime financial-services defense hospitality

Targeted Countries

KR AU RU BR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.001

Capability (Malware)

Astaroth Backdoors Batch script(s)

Infrastructure

pozeny.shop log.Log randPermDic.txt

4 Exploitation

Capability (Techniques)

T1053.005 T1059.001

Capability (Malware)

Astaroth Backdoors Batch script(s)

Infrastructure

pozeny.shop log.Log randPermDic.txt

5 Installation

Capability (Techniques)

T1136.001

Capability (Malware)

Astaroth Backdoors Batch script(s)

Infrastructure

pozeny.shop log.Log randPermDic.txt

6 Command & Control

Capability (Techniques)

T1056.001 T1113 T1105 T1021.004

Capability (Malware)

Astaroth Backdoors Batch script(s)

Infrastructure

pozeny.shop log.Log randPermDic.txt