Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

LofyGang (threat actor)

Risk

High

4 techniques 52 tools/malware 1 vulnerabilities 37 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1195

Supply Chain Compromise initial access

T1195.002

Compromise Software Supply Chain initial access

›

4 Exploitation

CVE CVE-2022-40684

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1055

Process Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (52)

Agent Tesla Azorult BazarBackdoor BeaverTail Beavertail Buer Cobalt Cobalt Strike Custom tooling DanaBot Dark DarkComet Dridex Emotet Exodus Firefox Formbook Gh0st Ghost RAT GitHub IcedID InvisibleFerret LaZagne Lofy LofyBoost LofyStealer NETWIRE Nitro Node.js PLAY Payload Payload PlugX PowerShell Quasar Quasar RAT Retro Schtasks ScreenLiveClient Slinky SmokeLoader Telegram TrickBot Trojan VBScript Zloader chromelevator.exe gh0st RAT ostap phishing schtasks undicy-http

Indicators of Compromise (37)

Domain

myexternalip.com ipinfo.io fs.writeFileSync about.fb.com process.env path.join os.tmpdir objShell.Run +14 more

Filename

MSVCP140.dll VCRUNTIME140.dll client.js ntdll.dll chromelevator.exe index.js wscript.exe svchost.vbs +5 more

IPv4 Address

24.152.36.243 172.67.173.92

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

10 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (6)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1018 User Account Management M1033 Limit Software Installation M1046 Boot Integrity +1 more

Actions on Objectives (4)

M1026 Privileged Account Management M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1057 Data Loss Prevention

Detection Coverage

4 strategies

2/7 stages covered

Delivery (2)

DET0309 Compromised software/update chain (insta... DET0537 Behavioral detection for Supply Chain Co...

Actions on Objectives (2)

DET0348 Detection Strategy for Exfiltration Over... DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

50%

LofyGang

Type: apt Active

GrabBot TeviRAT FIN11 Graceful Spider TA505 +2 more

Infrastructure 24 IOC(s)

50%

Domain

myexternalip.com ipinfo.io fs.writeFileSync about.fb.com process.env +17

IPv4 Address

24.152.36.243 172.67.173.92

Artifacts (13)

MSVCP140.dll VCRUNTIME140.dll client.js ntdll.dll chromelevator.exe index.js +7

Capability

50%

4 technique(s) 52 tool(s)/malware 1 CVE(s)

Agent Tesla Azorult BazarBackdoor BeaverTail Beavertail Buer Cobalt Cobalt Strike +44

exfiltration

T1041

initial access

T1195 T1195.002

stealth

T1055

Victim

70%

Targeted Sectors

gaming financial-services media government

Targeted Countries

KP BR NL

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Apt

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1195 T1195.002

Capability (Malware)

Agent Tesla Azorult BazarBackdoor

Infrastructure

myexternalip.com ipinfo.io fs.writeFileSync

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Agent Tesla Azorult BazarBackdoor

Infrastructure

myexternalip.com ipinfo.io fs.writeFileSync