Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Kimsuky (threat actor)
Risk
88
Critical
155 techniques 59 tools/malware 1 vulnerabilities 106 IOCs 7/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
11
T1589
Gather Victim Identity Information reconnaissance
T1589.002
Email Addresses reconnaissance
T1589.003
Employee Names reconnaissance
T1591
Gather Victim Org Information reconnaissance
T1593.001
Social Media reconnaissance
T1593.002
Search Engines reconnaissance
T1594
Search Victim-Owned Websites reconnaissance
T1596
Search Open Technical Databases reconnaissance
T1598
Phishing for Information reconnaissance
T1598.003
Spearphishing Link reconnaissance
T1682
Query Public AI Services reconnaissance
›
2 Weaponization
17
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.004
Server resource development
T1583.006
Web Services resource development
T1584
Compromise Infrastructure resource development
T1584.001
Domains resource development
T1585
Establish Accounts resource development
T1585.001
Social Media Accounts resource development
T1585.002
Email Accounts resource development
T1586
Compromise Accounts resource development
T1586.002
Email Accounts resource development
T1587
Develop Capabilities resource development
T1587.001
Malware resource development
T1588.002
Tool resource development
T1588.003
Code Signing Certificates resource development
T1588.005
Exploits resource development
T1608.001
Upload Malware resource development
›
3 Delivery
5
T1189
Drive-by Compromise initial access
T1190
Exploit Public-Facing Application initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
15
T1053.005
Scheduled Task execution
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.005
Visual Basic execution
T1059.006
Python execution
T1059.007
JavaScript execution
T1106
Native API execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
T1204.004
Malicious Copy and Paste execution
T1559.001
Component Object Model execution
T1546
Event Triggered Execution privilege escalation
T1546.001
Change Default File Association privilege escalation
CVE CVE-2020-0688
›
5 Installation
31
T1003.001
LSASS Memory credential access
T1040
Network Sniffing credential access
T1111
Multi-Factor Authentication Interception credential access
T1539
Steal Web Session Cookie credential access
T1552.001
Credentials In Files credential access
T1552.004
Private Keys credential access
T1555
Credentials from Password Stores credential access
T1555.003
Credentials from Web Browsers credential access
T1557
Adversary-in-the-Middle credential access
T1007
System Service Discovery discovery
T1012
Query Registry discovery
T1016
System Network Configuration Discovery discovery
T1033
System Owner/User Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1124
System Time Discovery discovery
T1217
Browser Information Discovery discovery
T1518.001
Security Software Discovery discovery
T1680
Local Storage Discovery discovery
T1098
Account Manipulation persistence
T1098.007
Additional Local or Domain Groups persistence
T1133
External Remote Services persistence
T1136
Create Account persistence
T1136.001
Local Account persistence
T1176.001
Browser Extensions persistence
T1505.003
Web Shell persistence
T1543
Create or Modify System Process persistence
T1543.003
Windows Service persistence
T1547
Boot or Logon Autostart Execution persistence
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
30
T1005
Data from Local System collection
T1056.001
Keylogging collection
T1056.003
Web Portal Capture collection
T1056.004
Credential API Hooking collection
T1074
Data Staged collection
T1074.001
Local Data Staging collection
T1113
Screen Capture collection
T1114
Email Collection collection
T1114.002
Remote Email Collection collection
T1114.003
Email Forwarding Rule collection
T1115
Clipboard Data collection
T1185
Browser Session Hijacking collection
T1560
Archive Collected Data collection
T1560.001
Archive via Utility collection
T1560.003
Archive via Custom Method collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1071.002
File Transfer Protocols command and control
T1071.003
Mail Protocols command and control
T1102.001
Dead Drop Resolver command and control
T1102.002
Bidirectional Communication command and control
T1105
Ingress Tool Transfer command and control
T1132
Data Encoding command and control
T1132.002
Non-Standard Encoding command and control
T1219.002
Remote Desktop Software command and control
T1568
Dynamic Resolution command and control
T1021
Remote Services lateral movement
T1021.001
Remote Desktop Protocol lateral movement
T1534
Internal Spearphishing lateral movement
T1550.002
Pass the Hash lateral movement
›
7 Actions on Objectives
47
T1112
Modify Registry defense impairment
T1553.002
Code Signing defense impairment
T1685
Disable or Modify Tools defense impairment
T1686
Disable or Modify System Firewall defense impairment
T1020
Automated Exfiltration exfiltration
T1041
Exfiltration Over C2 Channel exfiltration
T1567
Exfiltration Over Web Service exfiltration
T1567.002
Exfiltration to Cloud Storage exfiltration
T1485
Data Destruction impact
T1489
Service Stop impact
T1657
Financial Theft impact
T1027
Obfuscated Files or Information stealth
T1027.001
Binary Padding stealth
T1027.002
Software Packing stealth
T1027.007
Dynamic API Resolution stealth
T1027.010
Command Obfuscation stealth
T1027.012
LNK Icon Smuggling stealth
T1027.013
Encrypted/Encoded File stealth
T1027.015
Compression stealth
T1027.016
Junk Code Insertion stealth
T1036
Masquerading stealth
T1036.004
Masquerade Task or Service stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1036.007
Double File Extension stealth
T1055
Process Injection stealth
T1055.001
Dynamic-link Library Injection stealth
T1055.012
Process Hollowing stealth
T1070.004
File Deletion stealth
T1070.006
Timestomp stealth
T1078.003
Local Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1205
Traffic Signaling stealth
T1218.005
Mshta stealth
T1218.010
Regsvr32 stealth
T1218.011
Rundll32 stealth
T1480
Execution Guardrails stealth
T1480.002
Mutual Exclusion stealth
T1497.001
System Checks stealth
T1564
Hide Artifacts stealth
T1564.002
Hidden Users stealth
T1564.003
Hidden Window stealth
T1564.011
Ignore Process Interrupts stealth
T1620
Reflective Code Loading stealth
T1678
Delay Execution stealth
T1684.001
Impersonation stealth
T1064
T1064
T1156
T1156
Stage risk: Critical High Medium None

Tools & Malware (59)

Amadey Apollo AppleSeed AppleSeed backdoor AutoIt BANSHEE BabyShark Brave Prince CSPY Downloader ClickFix Eternal suite of exploits FPSpy GREASE GitHub Global GoBear Gold Dragon Gomir Grease HTTPTroy KGH_SPY KLogEXE KPortScan Kimsuky LNK files Leverage MECHANICAL Mechanical Mimikatz NOKKI NirSoft MailPassView/Network Password Recovery/Remote Desktop PassView/SniffPass/WebBrowserPassView PEBBLEDASH Payload Payload Phishing campaigns Phishing emails PowerShell PowerShell scripts Procdump PsExec QuasarRAT RftRAT Rundll32 STOP SentinelOne Spear-phishing Spear-phishing Campaigns Spear-phishing emails TRANSLATEXT Troll Stealer Unknown WebBrowserPassView WildFire Windows Command Shell gh0st RAT mshta phishing procdump xRAT (Quasar RAT‑based)

Indicators of Compromise (106)

Domain
coalink.support callsdk.online tattomc.com prvservice.com techcross-es.com stomcs.com sevrrhst.com xhrxqnovq.dynv6.net +47 more
Filename
temp.vbs powershell.exe cmd.exe patch.dll rundll32.exe sys.dll explorer.exe mshta.exe +2 more
SHA-1 Hash
c8f54cb73c240a1904030eb36bb2baa7db6aeb01 86a025e282495584eabece67e4e2a43dca28e505
SHA-256 Hash
60dfa5b92193cdc80fd759cd5a228527b1019c4706e5a1ed2e9bce3c232ef531 a173a425d17b6f2362eca3c8ea4de9860b52faba414bbb22162895641dda0dc2 47cc83176cd36abf0b5624f33bcf044b8f880cf521689981f891e52fbb3dbfa3
IPv4 Address
144.172.110.53 88.119.171.59 152.32.138.167 27.102.137.59
URL
http://udnvk.site http://jqmknjgty.v6.rocks http://27.102.137.59 http://ezglwomyf.v6.rocks http://gowkduemz.v6.rocks http://gdqjooukrk.v6.rocks http://hguwjk.v6.army http://flvidgu.v6.rocks +24 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

36 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Reconnaissance (3)
M1017 User Training M1054 Software Configuration M1056 Pre-compromise
Weaponization (1)
M1056 Pre-compromise
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (15)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1028 Operating System Configuration +10 more
Installation (23)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +18 more
Command & Control (19)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1027 Password Policies +14 more
Actions on Objectives (27)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content +22 more

Detection Coverage

153 strategies
7/7 stages covered

Reconnaissance (11)

DET0810 Detection of Search Victim-Owned Website... DET0811 Detection of Search Engines DET0812 Detection of Social Media DET0814 Detection of Email Addresses DET0823 Detection of Phishing for Information +6 more

Weaponization (17)

DET0824 Detection of Upload Malware DET0827 Detection of Exploits DET0835 Detection of Email Accounts DET0851 Detection of Social Media Accounts DET0852 Detection of Tool +12 more

Delivery (5)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (14)

DET0010 Behavioral Detection of Event Triggered... DET0061 Detect Default File Association Hijack v... DET0063 Cross-Platform Behavioral Detection of P... DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... +9 more

Installation (31)

DET0013 Detection of Local Browser Artifact Acce... DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0037 Detect Suspicious Access to Browser Cred... DET0044 Detecting Malicious Browser Extensions A... +26 more

Command & Control (30)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0035 Detect Bidirectional Web Service C2 Chan... DET0039 Detection Strategy for Dynamic Resolutio... DET0048 Detect Remote Email Collection via Abnor... +25 more

Actions on Objectives (45)

DET0021 Behavioral Detection for Service Stop ac... DET0023 Obfuscated Binary Unpacking Detection vi... DET0067 Detection Strategy for Ignore Process In... DET0087 Encrypted or Encoded File Payload Detect... DET0091 Detection Strategy for Dynamic API Resol... +40 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Kimsuky

Type: Unknown Active
Black Banshee Velvet Chollima Emerald Sleet THALLIUM APT43 +13 more
Infrastructure 91 IOC(s)
50%
Domain
coalink.support callsdk.online tattomc.com prvservice.com techcross-es.com +50
IPv4 Address
144.172.110.53 88.119.171.59 152.32.138.167 27.102.137.59
URL
http://udnvk.site http://jqmknjgty.v6.rocks http://27.102.137.59 http://ezglwomyf.v6.rocks http://gowkduemz.v6.rocks +27
Artifacts (15)
temp.vbs powershell.exe cmd.exe patch.dll rundll32.exe sys.dll +9
Capability
84%
155 technique(s) 59 tool(s)/malware 1 CVE(s)
Amadey Apollo AppleSeed AppleSeed backdoor AutoIt BANSHEE BabyShark Brave Prince +51
T1064 T1156
collection
T1005 T1056.001 T1056.003 T1056.004 +11
command and control
T1071 T1071.001 T1071.002 T1071.003 +7
credential access
T1003.001 T1040 T1111 T1539 +5
Victim
70%

Targeted Sectors

government financial-services energy think tank think-tank defense education nuclear media pharmaceutical manufacturing healthcare non-profit transportation critical-infrastructure

Targeted Countries

KR KP US JP RU CN UA PK

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Malware)

Amadey Apollo AppleSeed
2 Weaponization

Capability (Malware)

Amadey Apollo AppleSeed
3 Delivery

Capability (Malware)

Amadey Apollo AppleSeed
4 Exploitation

Capability (Malware)

Amadey Apollo AppleSeed
5 Installation

Capability (Malware)

Amadey Apollo AppleSeed
6 Command & Control

Capability (Malware)

Amadey Apollo AppleSeed
7 Actions on Objectives

Capability (Malware)

Amadey Apollo AppleSeed
Leaving Threaticon

This link opens an external site that isn't part of the platform.