Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
Darkhotel (threat actor)
Risk
76
Critical
24 techniques 7 tools/malware 0 vulnerabilities 60 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1189
Drive-by Compromise initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
3
T1059.003
Windows Command Shell execution
T1203
Exploitation for Client Execution execution
T1204.002
Malicious File execution
›
5 Installation
7
T1016
System Network Configuration Discovery discovery
T1057
Process Discovery discovery
T1082
System Information Discovery discovery
T1083
File and Directory Discovery discovery
T1124
System Time Discovery discovery
T1518.001
Security Software Discovery discovery
T1547.001
Registry Run Keys / Startup Folder persistence
›
6 Command & Control
5
T1056.001
Keylogging collection
T1105
Ingress Tool Transfer command and control
T1573.001
Symmetric Cryptography command and control
T1080
Taint Shared Content lateral movement
T1091
Replication Through Removable Media lateral movement
›
7 Actions on Objectives
7
T1553.002
Code Signing defense impairment
T1027.013
Encrypted/Encoded File stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1497
Virtualization/Sandbox Evasion stealth
T1497.001
System Checks stealth
T1497.002
User Activity Based Checks stealth
Stage risk: Critical High Medium None

Tools & Malware (7)

Asruex CVE-2010-2883 CVE-2012-0158 CVE-2015-8651 CVE-2016-4171 and CVE-2018-817 Win32.Karba Win32.Pioneer

Indicators of Compromise (60)

Domain
view-drama-online.com all-microsoft-control.com
MD5 Hash
1ee3dfce97ab318b416c1ba7463ee405 2899f4099c76232d6362fd62ab730741 2dee887b20a06b8e556e878c62e46e13 6b9e9b2dc97ff0b26a8a61ba95ca8ff6 852a9411a949add69386a72805c8cb05 be59994b5008a0be48934a9c5771dfa5 e29693ce15acd552f1a0435e2d31d6df fa67142728e40a2a4e97ccc6db919f2b +20 more
SHA-1 Hash
a041c1ebd3851cd738ed8366feecb64ed180faa5 c6e77cb10563d7c4dcb20d4c5a4ea16ef2f01ee8 cfc9cf21598961be0a9598b61403e9206c24ea19 cdaba7cea55bd490f9d152796db4c86d1d58d0da 33911793dc1db6ea2f2271a3d4ef57a8f141abc1
SHA-256 Hash
9d480e8dd52b18dae237e48d88a621fa209b6c2ed43cc261de6a5b30d8c56b11 7c3193439b8490403d3d5608bc7b85482b408c38cfcfbc4dcf4142eb32c8a7e0 bfaa6490bee525a9ea6671e3a3e1b7041f4cbdc4f37e401587101d649d8db810 03607dbb3b2d164ee2e1fb8a399a044fb1867e63cc6d64b7cfa06331ad1eb3cb eca1437ededc3f8692516dc907a5bd4390bcc4be0ae65b5e261a1f5dd352d3ee
URL
sendspace.servermsys.com/wnctprx error-page.net/update/load.php photo.storyonboard.net/wmpsrx64 photo.storyonboard.net/photoviewer.hta photo.storyonboard.net/readme.php unionnewsreport.net/aeroflot_bonus/ticket.php www.openofficev.info/xopen88/office2 www.openofficev.info/dec98/unzip.js +12 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more
Exploitation (6)
M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1048 Application Isolation and Sandboxing M1050 Exploit Protection +1 more
Command & Control (9)
M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1034 Limit Hardware Installation M1037 Filter Network Traffic M1038 Execution Prevention +4 more
Actions on Objectives (5)
M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1045 Code Signing M1049 Antivirus/Antimalware

Detection Coverage

24 strategies
5/7 stages covered

Delivery (2)

DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (3)

DET0202 Behavioral Detection of Windows Command... DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down...

Installation (7)

DET0016 Security Software Discovery Across Platf... DET0034 Detection of Adversarial Process Discove... DET0151 Behavior-chain, platform-aware detection... DET0195 Behavioral Detection of System Network C... DET0365 Detect Registry and Startup Folder Persi... +2 more

Command & Control (5)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0089 Behavioral Detection of Keylogging Activ... DET0143 Detection Strategy for Encrypted Channel... DET0301 Removable Media Execution Chain Detectio... DET0471 Detection of Tainted Content Written to...

Actions on Objectives (7)

DET0046 Detection Strategy for T1497 Virtualizat... DET0087 Encrypted or Encoded File Payload Detect... DET0168 Virtualization/Sandbox Evasion via Syste... DET0230 Detect Suspicious or Malicious Code Sign... DET0275 Detect Adversary Deobfuscation or Decodi... +2 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

Darkhotel

Type: Unknown Active
DUBNIUM Zigzag Hail Luder Karba Tapaoux +11 more
Infrastructure 22 IOC(s)
50%
Domain
view-drama-online.com all-microsoft-control.com
URL
sendspace.servermsys.com/wnctprx error-page.net/update/load.php photo.storyonboard.net/wmpsrx64 photo.storyonboard.net/photoviewer.hta photo.storyonboard.net/readme.php +15
Artifacts (38)
1ee3dfce97ab318b416c1ba7463ee405 2899f4099c76232d6362fd62ab730741 2dee887b20a06b8e556e878c62e46e13 6b9e9b2dc97ff0b26a8a61ba95ca8ff6 852a9411a949add69386a72805c8cb05 be59994b5008a0be48934a9c5771dfa5 +32
Capability
90%
24 technique(s) 7 tool(s)/malware
Asruex CVE-2010-2883 CVE-2012-0158 CVE-2015-8651 CVE-2016-4171 and CVE-2018-817 Win32.Karba Win32.Pioneer
collection
T1056.001
command and control
T1105 T1573.001
defense impairment
T1553.002
discovery
T1016 T1057 T1082 T1083 +2
Victim
70%

Targeted Sectors

government

Targeted Countries

RU CN TW KR KP JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001

Capability (Malware)

Asruex CVE-2010-2883 CVE-2012-0158
4 Exploitation

Capability (Techniques)

T1059.003 T1203 T1204.002

Capability (Malware)

Asruex CVE-2010-2883 CVE-2012-0158
5 Installation

Capability (Malware)

Asruex CVE-2010-2883 CVE-2012-0158
6 Command & Control

Capability (Malware)

Asruex CVE-2010-2883 CVE-2012-0158
Leaving Threaticon

This link opens an external site that isn't part of the platform.