Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

MirrorFace (threat actor)

Risk

Critical

43 techniques 9 tools/malware 0 vulnerabilities 21 IOCs 7/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

T1591

Gather Victim Org Information reconnaissance

›

2 Weaponization

T1587.001

Malware resource development

T1588.002

Tool resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1059.003

Windows Command Shell execution

T1059.005

Visual Basic execution

T1204.002

Malicious File execution

›

5 Installation

T1003.001

LSASS Memory credential access

T1003.002

Security Account Manager credential access

T1003.003

NTDS credential access

T1007

System Service Discovery discovery

T1016

System Network Configuration Discovery discovery

T1018

Remote System Discovery discovery

T1033

System Owner/User Discovery discovery

T1057

Process Discovery discovery

T1082

System Information Discovery discovery

T1083

File and Directory Discovery discovery

T1087.002

Domain Account discovery

T1482

Domain Trust Discovery discovery

T1614.001

System Language Discovery discovery

›

6 Command & Control

T1005

Data from Local System collection

T1074.002

Remote Data Staging collection

T1114.001

Local Email Collection collection

T1560.001

Archive via Utility collection

T1071.002

File Transfer Protocols command and control

T1090

Proxy command and control

T1021.001

Remote Desktop Protocol lateral movement

T1021.002

SMB/Windows Admin Shares lateral movement

›

7 Actions on Objectives

T1553.002

Code Signing defense impairment

T1556.002

Password Filter DLL defense impairment

T1685

Disable or Modify Tools defense impairment

T1685.005

Clear Windows Event Logs defense impairment

T1686.003

Windows Host Firewall defense impairment

T1048.002

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol exfiltration

T1027.013

Encrypted/Encoded File stealth

T1036.008

Masquerade File Type stealth

T1070.004

File Deletion stealth

T1221

Template Injection stealth

T1574.001

DLL stealth

T1684.001

Impersonation stealth

Stage risk: Critical High Medium None

Tools & Malware (9)

Cobalt Strike Cobalt Strike - S0154 DOWNIISSA HiddenFace LODEINFO MirrorStealer NOOPLDR ROAMINGHOUSE UPPERCUT

Indicators of Compromise (21)

Domain

vu4fleh3yd4ehpfpciinnwbnh4b77rdeypubhqr2dgfibjtvxpdxozid.onion u4mrhg3y6jyfw2dmm2wnocz3g3etp2xc5thzx77uelk7mrk7qtjmc6qd.onion

SHA-1 Hash

d2c25af9ee6e60a341b0c93dd97566fb532bfbe8 f5ba545d4a16836756989a3ab32f3f6c5d5ad8ff 233029813051d20b61d057ec4a56337e9bec40d2 8361f7dbf81093928da54e3cbc11a0fcc2eeb55a 1afdce38af37b9452fb4ac35de9fcecd5629b891 e3da9467d0c89a9312ea199ecc83cddf3607d8b1 018944fc47ee2329b23b74da31b19e57373ff539 68b72da59467b1bb477d0c1c5107cee8d9078e7e +6 more

IPv4 Address

64.176.56.26 104.233.167.135 152.42.202.137 208.85.18.4 45.32.116.146

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

34 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Reconnaissance (1)

M1056 Pre-compromise

Weaponization (1)

M1056 Pre-compromise

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (8)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1038 Execution Prevention +3 more

Installation (10)

M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +5 more

Command & Control (15)

M1018 User Account Management M1020 SSL/TLS Inspection M1026 Privileged Account Management M1027 Password Policies M1028 Operating System Configuration +10 more

Actions on Objectives (21)

M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1022 Restrict File and Directory Permissions +16 more

Detection Coverage

43 strategies

7/7 stages covered

Reconnaissance (1)

DET0890 Detection of Gather Victim Org Informati...

Weaponization (2)

DET0852 Detection of Tool DET0872 Detection of Malware

Delivery (3)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0364 Behavioral Detection Strategy for WMI Ex...

Installation (13)

DET0007 Detection of Domain Trust Discovery via... DET0034 Detection of Adversarial Process Discove... DET0085 Credential Dumping from SAM via Registry... DET0093 Behavioral Detection of User Discovery v... DET0129 Domain Account Enumeration Across Platfo... +8 more

Command & Control (8)

DET0047 Detect Local Email Collection via Outloo... DET0071 Detection of Remote Data Staging Prior t... DET0298 Detect Archiving via Utility (T1560.001) DET0327 Multi-event Detection Strategy for RDP-B... DET0380 Detection of Local Data Collection Prior... +3 more

Actions on Objectives (12)

DET0087 Encrypted or Encoded File Payload Detect... DET0140 Behavioral Detection of Malicious File D... DET0201 Detection Strategy for Hijack Execution... DET0226 Detection Strategy for Masquerading via... DET0230 Detect Suspicious or Malicious Code Sign... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

3/4

Adversary

Confidence

90%

MirrorFace

Type: Unknown Active

Earth Kasha

Infrastructure 7 IOC(s)

50%

Domain

vu4fleh3yd4ehpfpciinnwbnh4b77rdeypubhqr2dgfibjtvxpdxozid.onion u4mrhg3y6jyfw2dmm2wnocz3g3etp2xc5thzx77uelk7mrk7qtjmc6qd.onion

IPv4 Address

64.176.56.26 104.233.167.135 152.42.202.137 208.85.18.4 45.32.116.146

Artifacts (14)

Capability

90%

43 technique(s) 9 tool(s)/malware

Cobalt Strike Cobalt Strike - S0154 DOWNIISSA HiddenFace LODEINFO MirrorStealer NOOPLDR ROAMINGHOUSE +1

collection

T1005 T1074.002 T1114.001 T1560.001

command and control

T1071.002 T1090

credential access

T1003.001 T1003.002 T1003.003

defense impairment

T1553.002 T1556.002 T1685 T1685.005 +1

Victim

No victim targeting data available.

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

1 Reconnaissance

Capability (Techniques)

T1591

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 DOWNIISSA

Infrastructure

vu4fleh3yd4ehpfpciinnwbnh4b77rdeypubhqr2dgfibjtvxpdxozid.onion u4mrhg3y6jyfw2dmm2wnocz3g3etp2xc5thzx77uelk7mrk7qtjmc6qd.onion 64.176.56.26

2 Weaponization

Capability (Techniques)

T1587.001 T1588.002

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 DOWNIISSA

Infrastructure

vu4fleh3yd4ehpfpciinnwbnh4b77rdeypubhqr2dgfibjtvxpdxozid.onion u4mrhg3y6jyfw2dmm2wnocz3g3etp2xc5thzx77uelk7mrk7qtjmc6qd.onion 64.176.56.26

3 Delivery

Capability (Techniques)

T1190 T1566.001 T1566.002

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 DOWNIISSA

Infrastructure

vu4fleh3yd4ehpfpciinnwbnh4b77rdeypubhqr2dgfibjtvxpdxozid.onion u4mrhg3y6jyfw2dmm2wnocz3g3etp2xc5thzx77uelk7mrk7qtjmc6qd.onion 64.176.56.26

4 Exploitation

Capability (Techniques)

T1047 T1059.003 T1059.005 T1204.002

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 DOWNIISSA

Infrastructure

vu4fleh3yd4ehpfpciinnwbnh4b77rdeypubhqr2dgfibjtvxpdxozid.onion u4mrhg3y6jyfw2dmm2wnocz3g3etp2xc5thzx77uelk7mrk7qtjmc6qd.onion 64.176.56.26

5 Installation

Capability (Techniques)

T1003.001 T1003.002 T1003.003 T1007 T1016

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 DOWNIISSA

Infrastructure

vu4fleh3yd4ehpfpciinnwbnh4b77rdeypubhqr2dgfibjtvxpdxozid.onion u4mrhg3y6jyfw2dmm2wnocz3g3etp2xc5thzx77uelk7mrk7qtjmc6qd.onion 64.176.56.26

6 Command & Control

Capability (Techniques)

T1005 T1074.002 T1114.001 T1560.001 T1071.002

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 DOWNIISSA

Infrastructure

vu4fleh3yd4ehpfpciinnwbnh4b77rdeypubhqr2dgfibjtvxpdxozid.onion u4mrhg3y6jyfw2dmm2wnocz3g3etp2xc5thzx77uelk7mrk7qtjmc6qd.onion 64.176.56.26

7 Actions on Objectives

Capability (Techniques)

T1048.002

Capability (Malware)

Cobalt Strike Cobalt Strike - S0154 DOWNIISSA

Infrastructure

vu4fleh3yd4ehpfpciinnwbnh4b77rdeypubhqr2dgfibjtvxpdxozid.onion u4mrhg3y6jyfw2dmm2wnocz3g3etp2xc5thzx77uelk7mrk7qtjmc6qd.onion 64.176.56.26