Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

TA505 (threat actor)

Risk

Critical

34 techniques 13 tools/malware 0 vulnerabilities 156 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1583.001

Domains resource development

T1588.001

Malware resource development

T1588.002

Tool resource development

T1608.001

Upload Malware resource development

›

3 Delivery

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1059.005

Visual Basic execution

T1059.007

JavaScript execution

T1106

Native API execution

T1204.001

Malicious Link execution

T1204.002

Malicious File execution

T1559.002

Dynamic Data Exchange execution

›

5 Installation

T1552.001

Credentials In Files credential access

T1555.003

Credentials from Web Browsers credential access

T1069

Permission Groups Discovery discovery

T1087.003

Email Account discovery

›

6 Command & Control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1568.001

Fast Flux DNS command and control

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1553.002

Code Signing defense impairment

T1553.005

Mark-of-the-Web Bypass defense impairment

T1685

Disable or Modify Tools defense impairment

T1486

Data Encrypted for Impact impact

T1027.002

Software Packing stealth

T1027.010

Command Obfuscation stealth

T1027.013

Encrypted/Encoded File stealth

T1055.001

Dynamic-link Library Injection stealth

T1078.002

Domain Accounts stealth

T1140

Deobfuscate/Decode Files or Information stealth

T1218.007

Msiexec stealth

T1218.011

Rundll32 stealth

Stage risk: Critical High Medium None

Tools & Malware (13)

Amadey Azorult Clop Cobalt Strike Cobalt Strike - S0154 Dridex FlawedAmmyy FlawedGrace Get2 Remote Manipulator System SDBbot ServHelper TrickBot

Indicators of Compromise (156)

Domain

saudjyyvv663.xyz soajfvhv235ua.xyz whereihjeu3.xyz teahgiaj3ig.cn sagbbrrww2.cn sagiai3agar.cn saidifufaysydas.cn saidijfjv9as.xyz +35 more

MD5 Hash

4acd155b901884134f01b383eb035c23 4a8198fca604a78dd210803aebd5cbba 4ca90e372982c864b8eae6d95161a213 2d3238185537429ea693a81a1c6ca4c0

SHA-1 Hash

ad35fa0b3799562931b4bfa3abd057214b8721ff 880b383532534e32f3fa49692d676d9488aabac1 63aeb16b5d001cbd94b636e9f557fe97b8467c8d 06f232210e507f09f01155e7d0cb5389b8a31042

SHA-256 Hash

b5e776f84f8f01fcc1fb822ff5612afe62097bf367ced2187fda0b5bf3d652ee 843578299d9e60e52f781ca487aa83f5df4c5f4ca71d3a941a8ea249476c5c3c cd7bb7396f21c88742fefb278e6e7c9a564dfe109b434494d159518175739c40 c0bcd76c486a8c8994fc005d83d64716ed3604c8559463867412c446e5364169 9dc1381816b8b18aead256bdc05486171968abbc6ff01766088fbfe7badd194e 755549aead02c8b524e31f9c511ca4395bdcae8c465e3298b90152ec8b8a6ae0 a1219acec7d8b85c7b4626536074eeff8db803b50f60e6f87eaa4289b9e4d326 1b3740d9a8511ddfdb657cd796c7bd0adb49bf8f63490df0248ff07d19cd4294 +75 more

IPv4 Address

79.141.171.160 185.163.45.56 185.163.47.171 185.163.47.210 194.180.174.20 194.180.174.56 206.188.197.203 206.188.197.221 +14 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

22 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more

Exploitation (11)

M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1038 Execution Prevention +6 more

Installation (7)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1027 Password Policies +2 more

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (15)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1024 Restrict Registry Permissions M1026 Privileged Account Management +10 more

Detection Coverage

34 strategies

6/7 stages covered

Weaponization (4)

DET0824 Detection of Upload Malware DET0845 Detection of Malware DET0852 Detection of Tool DET0892 Detection of Domains

Delivery (2)

DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (8)

DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... DET0294 User Execution – Malicious File via down... +3 more

Installation (4)

DET0037 Detect Suspicious Access to Browser Cred... DET0179 Behavioral Detection of Permission Group... DET0229 Enumeration of Global Address Lists via... DET0307 Detect Access to Unsecured Credential Fi...

Command & Control (3)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0485 Detection Strategy for Dynamic Resolutio...

Actions on Objectives (13)

DET0023 Obfuscated Binary Unpacking Detection vi... DET0087 Encrypted or Encoded File Payload Detect... DET0158 Detection of Msiexec Abuse for Local, Ne... DET0210 Abuse of Domain Accounts DET0215 Detection of Multi-Platform File Encrypt... +8 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

90%

TA505

Type: Unknown Active

Hive0065 Spandex Tempest CHIMBORAZO SectorJ04 SectorJ04 Group +5 more

Infrastructure 65 IOC(s)

50%

Domain

saudjyyvv663.xyz soajfvhv235ua.xyz whereihjeu3.xyz teahgiaj3ig.cn sagbbrrww2.cn +38

IPv4 Address

79.141.171.160 185.163.45.56 185.163.47.171 185.163.47.210 194.180.174.20 +17

Artifacts (91)

4acd155b901884134f01b383eb035c23 4a8198fca604a78dd210803aebd5cbba 4ca90e372982c864b8eae6d95161a213 2d3238185537429ea693a81a1c6ca4c0 ad35fa0b3799562931b4bfa3abd057214b8721ff 880b383532534e32f3fa49692d676d9488aabac1 +85

Capability

90%

34 technique(s) 13 tool(s)/malware

Amadey Azorult Clop Cobalt Strike Cobalt Strike - S0154 Dridex FlawedAmmyy FlawedGrace +5

command and control

T1071.001 T1105 T1568.001

credential access

T1552.001 T1555.003

defense impairment

T1112 T1553.002 T1553.005 T1685

discovery

T1069 T1087.003

Victim

70%

Targeted Sectors

financial services retail education financial-services healthcare

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1583.001 T1588.001 T1588.002 T1608.001

Capability (Malware)

Amadey Azorult Clop

Infrastructure

saudjyyvv663.xyz soajfvhv235ua.xyz whereihjeu3.xyz

3 Delivery

Capability (Techniques)

T1566.001 T1566.002

Capability (Malware)

Amadey Azorult Clop

Infrastructure

saudjyyvv663.xyz soajfvhv235ua.xyz whereihjeu3.xyz

4 Exploitation

Capability (Techniques)

T1059.001 T1059.003 T1059.005 T1059.007 T1106

Capability (Malware)

Amadey Azorult Clop

Infrastructure

saudjyyvv663.xyz soajfvhv235ua.xyz whereihjeu3.xyz

5 Installation

Capability (Techniques)

T1552.001 T1555.003 T1069 T1087.003

Capability (Malware)

Amadey Azorult Clop

Infrastructure

saudjyyvv663.xyz soajfvhv235ua.xyz whereihjeu3.xyz

6 Command & Control

Capability (Techniques)

T1071.001 T1105 T1568.001

Capability (Malware)

Amadey Azorult Clop

Infrastructure

saudjyyvv663.xyz soajfvhv235ua.xyz whereihjeu3.xyz

7 Actions on Objectives

Capability (Techniques)

T1486

Capability (Malware)

Amadey Azorult Clop

Infrastructure

saudjyyvv663.xyz soajfvhv235ua.xyz whereihjeu3.xyz