Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
WIRTE (threat actor)
Risk
85
Critical
42 techniques 51 tools/malware 3 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
8
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1586
Compromise Accounts resource development
T1586.002
Email Accounts resource development
T1588
Obtain Capabilities resource development
T1588.002
Tool resource development
T1608
Stage Capabilities resource development
T1608.001
Upload Malware resource development
›
3 Delivery
3
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
T1566.002
Spearphishing Link initial access
›
4 Exploitation
11
T1059
Command and Scripting Interpreter execution
T1059.001
PowerShell execution
T1059.003
Windows Command Shell execution
T1059.005
Visual Basic execution
T1106
Native API execution
T1204
User Execution execution
T1204.001
Malicious Link execution
T1204.002
Malicious File execution
CVE CVE-2025-0994
CVE CVE-2025-20333
CVE CVE-2025-20362
›
5 Installation
No data
›
6 Command & Control
8
T1074
Data Staged collection
T1074.001
Local Data Staging collection
T1114
Email Collection collection
T1114.001
Local Email Collection collection
T1071
Application Layer Protocol command and control
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
T1571
Non-Standard Port command and control
›
7 Actions on Objectives
15
T1041
Exfiltration Over C2 Channel exfiltration
T1027
Obfuscated Files or Information stealth
T1027.010
Command Obfuscation stealth
T1027.015
Compression stealth
T1036
Masquerading stealth
T1036.005
Match Legitimate Resource Name or Location stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1218
System Binary Proxy Execution stealth
T1218.010
Regsvr32 stealth
T1497
Virtualization/Sandbox Evasion stealth
T1497.001
System Checks stealth
T1574
Hijack Execution Flow stealth
T1574.001
DLL stealth
T1684
Social Engineering stealth
T1684.001
Impersonation stealth
Stage risk: Critical High Medium None

Tools & Malware (51)

Akira AshTag Ashen Backdoor malware Backdoors BlackByte C2 infrastructure Carbanak CloudSorcerer v3 Cobalt Custom malware Dark DracuLoader Explorer FINALDRAFT Ferocious GitHub Global Guard Havoc IronWind Kimsuky LitePower Malwarebytes MuddyWater Naikon NetDraft Nexus Payload Payload Phishing emails Phoenix Phoenix backdoor PowerShell Rclone Rootkit SNAPPYBEE SNOWLIGHT STOP STOWAWAY SameCoin Trojan UAT-8302 VShell Void WildFire Windows Command Shell Winnti ZingDoor phishing schtasks

Indicators of Compromise (40)

Domain
TEMP.Veles screenai.online api.healthylifefeed.com api.softmatictech.com auth.onlinefieldtech.com Win.Malware.Snappybee Win.Loader.Agent adconnectdump.py +11 more
Filename
Document.pdf cmd.exe svchost.exe rar.exe explorer.exe spoolsv.exe regsvr32.exe wtsapi32.dll +8 more
IPv4 Address
38.54.32.244 85.209.156.3 45.135.135.100 159.198.36.115
URL
http://:4444/chromium_stealer_user.exe

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

29 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (7)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +2 more
Exploitation (11)
M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more
Command & Control (7)
M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication M1037 Filter Network Traffic M1041 Encrypt Sensitive Information +2 more
Actions on Objectives (22)
M1013 Application Developer Guidance M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content +17 more

Detection Coverage

42 strategies
5/7 stages covered

Weaponization (8)

DET0824 Detection of Upload Malware DET0839 Detection of Stage Capabilities DET0850 Detection of Obtain Capabilities DET0852 Detection of Tool DET0861 Detection of Email Accounts +3 more

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0107 Detection Strategy for Spearphishing Lin... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (8)

DET0066 User Execution – Malicious Link (click →... DET0076 Behavioral Detection of Visual Basic Exe... DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0455 Abuse of PowerShell for Arbitrary Execut... +3 more

Command & Control (8)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0047 Detect Local Email Collection via Outloo... DET0060 Detect Ingress Tool Transfers via Behavi... DET0227 Detection Strategy for Non-Standard Port... +3 more

Actions on Objectives (15)

DET0046 Detection Strategy for T1497 Virtualizat... DET0081 Detection of Proxy Execution via Trusted... DET0127 Behavioral Detection of Masquerading Acr... DET0168 Virtualization/Sandbox Evasion via Syste... DET0201 Detection Strategy for Hijack Execution... +10 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
90%

WIRTE

Type: Unknown Active
Ashen Lepus network software application tracked as a pen name +13 more
Infrastructure 24 IOC(s)
50%
Domain
TEMP.Veles screenai.online api.healthylifefeed.com api.softmatictech.com auth.onlinefieldtech.com +14
IPv4 Address
38.54.32.244 85.209.156.3 45.135.135.100 159.198.36.115
URL
http://:4444/chromium_stealer_user.exe
Artifacts (16)
Document.pdf cmd.exe svchost.exe rar.exe explorer.exe spoolsv.exe +10
Capability
75%
42 technique(s) 51 tool(s)/malware 3 CVE(s)
Akira AshTag Ashen Backdoor malware Backdoors BlackByte C2 infrastructure Carbanak +43
collection
T1074 T1074.001 T1114 T1114.001
command and control
T1071 T1071.001 T1105 T1571
execution
T1059 T1059.001 T1059.003 T1059.005 +4
exfiltration
T1041
Victim
70%

Targeted Sectors

government financial-services defense telecommunications healthcare manufacturing education energy critical-infrastructure non-profit media pharmaceutical aviation hospitality aerospace retail information-technology think-tank transportation mining chemical gaming legal-services utilities nuclear entertainment oil-gas maritime food-agriculture construction

Targeted Countries

CN US RU IR IL JP VN GB AU SA PK TW AE UA CA TR SG KR IN DE BY MX ES PL EG RO FR NG KP IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

Akira AshTag Ashen
3 Delivery

Capability (Techniques)

T1566 T1566.001 T1566.002

Capability (Malware)

Akira AshTag Ashen
4 Exploitation

Capability (Malware)

Akira AshTag Ashen
6 Command & Control

Capability (Malware)

Akira AshTag Ashen
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

Akira AshTag Ashen
Leaving Threaticon

This link opens an external site that isn't part of the platform.