Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
1937CN (threat actor)
Risk
77
Critical
44 techniques 55 tools/malware 2 vulnerabilities 41 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
6
T1053
Scheduled Task/Job execution
T1053.005
Scheduled Task execution
T1059.001
PowerShell execution
T1204.002
Malicious File execution
CVE CVE-2012-0158
CVE CVE-2017-11882
›
5 Installation
6
T1046
Network Service Discovery discovery
T1069.001
Local Groups discovery
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1482
Domain Trust Discovery discovery
T1547.009
Shortcut Modification persistence
›
6 Command & Control
10
T1074
Data Staged collection
T1113
Screen Capture collection
T1119
Automated Collection collection
T1071.001
Web Protocols command and control
T1071.004
DNS command and control
T1090.001
Internal Proxy command and control
T1090.002
External Proxy command and control
T1090.003
Multi-hop Proxy command and control
T1105
Ingress Tool Transfer command and control
T1573.002
Asymmetric Cryptography command and control
›
7 Actions on Objectives
22
T1484
Domain or Tenant Policy Modification defense impairment
T1484.001
Group Policy Modification defense impairment
T1041
Exfiltration Over C2 Channel exfiltration
T1048
Exfiltration Over Alternative Protocol exfiltration
T1489
Service Stop impact
T1027
Obfuscated Files or Information stealth
T1055
Process Injection stealth
T1070
Indicator Removal stealth
T1070.004
File Deletion stealth
T1070.006
Timestomp stealth
T1078
Valid Accounts stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1042
T1042
T1053.001
T1053.001
T1060
T1060
T1086
T1086
T1107
T1107
T1117
T1117
T1520
T1520
T1562.010
T1562.010
T1574.002
T1574.002
T1574.003
T1574.003
Stage risk: Critical High Medium None

Tools & Malware (55)

Backdoors Beacon CHINACHOPPER CVE-2012-0158 CVE-2017-11882 Chaos Cobalt Cobalt Strike Cobalt Strike BEACON Cobalt Strike EarthWorm EarthWorm network intrusion tool Earthworm Enfal Ghost RAT Global Go‑lang backdoor Hafnium Hellsing Kimsuky Korplug Legitimate Software MACAMAX MACAMAX backdoor Macro‑enabled Office documents Mimikatz NewCore RAT Nitro Payload Payload PcClient backdoor PcCortr backdoor Phishing emails PittyTiger PlugX PlugX/Korplug RAT PowerShell Python 3 Python-based Information Stealer Remote access trojans Rundll32 SUNBURST SharpHound ShellFang ShellFang loader Sisfader Sisfader RAT SolarWinds Spear-phishing Trojan Weaponized Microsoft Office Documents WinRAR Winnti Winrar phishing

Indicators of Compromise (41)

Domain
demo-cloud.space Army.mil lengs.medil.xml nkford.nlp attack.mitre.org
Filename
rundll32.exe gtn.dll win.exe gm.dll
SHA-256 Hash
af1d44b272cb2650f525879e772817f5bb4bf823c36a6e1f5c842f2fcc749930 af5301411e507dc142e671fc9a42f2fe32959add3a81fce2742dbf90536eebbd cb5e090a867e76214897efcb55a7d8908a36e874229c508ad97c0ebc437d79d8 de42dcc2f9094efbd37d65821992865eab1ef9b66e83c76f3fc8c1a800b54350 f910c0b18b5af4359e7354475add9f622aa92f945739a1c3b3bfc3704a037561 fce7a763c05711bc0ba110ed23651c0f18aceddae5ada6e8042a2664a35d18ec e5a170755ab090e944d1d24faef67ae1f80bac847f2a501937c9f03b888615c8 a270058cef51b49905d7ceb3df7b8b5bb7b60ebfb5099d8b177dc19a2064145c +24 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

32 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (11)
M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1028 Operating System Configuration +6 more
Installation (8)
M1018 User Account Management M1022 Restrict File and Directory Permissions M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention +3 more
Command & Control (5)
M1020 SSL/TLS Inspection M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information
Actions on Objectives (20)
M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +15 more

Detection Coverage

34 strategies
5/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (4)

DET0094 Cross-Platform Behavioral Detection of S... DET0294 User Execution – Malicious File via down... DET0441 Detection of Suspicious Scheduled Task C... DET0455 Abuse of PowerShell for Arbitrary Execut...

Installation (6)

DET0007 Detection of Domain Trust Discovery via... DET0114 Behavioral Detection of Local Group Enum... DET0180 Detection Strategy for T1547.009 – Short... DET0370 Recursive Enumeration of Files and Direc... DET0376 Behavioral Detection Strategy for Networ... +1 more

Command & Control (10)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0075 Internal Proxy Behavior via Lateral Host... DET0186 Automated File and API Collection Detect... +5 more

Actions on Objectives (12)

DET0021 Behavioral Detection for Service Stop ac... DET0131 Behavioral Detection Strategy for Exfilt... DET0140 Behavioral Detection of Malicious File D... DET0184 Behavioral Detection of Indicator Remova... DET0270 Detection of Domain or Tenant Policy Mod... +7 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

1937CN

Type: Unknown Active
Hellsing Goblin Panda APT27 APT43 Emerald Sleet +3 more
Infrastructure 5 IOC(s)
50%
Domain
demo-cloud.space Army.mil lengs.medil.xml nkford.nlp attack.mitre.org
Artifacts (36)
rundll32.exe gtn.dll win.exe gm.dll af1d44b272cb2650f525879e772817f5bb4bf823c36a6e1f5c842f2fcc749930 af5301411e507dc142e671fc9a42f2fe32959add3a81fce2742dbf90536eebbd +30
Capability
50%
44 technique(s) 55 tool(s)/malware 2 CVE(s)
Backdoors Beacon CHINACHOPPER CVE-2012-0158 CVE-2017-11882 Chaos Cobalt Cobalt Strike +47
T1042 T1053.001 T1060 T1086 +6
collection
T1074 T1113 T1119
command and control
T1071.001 T1071.004 T1090.001 T1090.002 +3
defense impairment
T1484 T1484.001
Victim
70%

Targeted Sectors

government aviation telecommunications defense media food-agriculture critical-infrastructure

Targeted Countries

CN VN NL TW IN US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

Backdoors Beacon CHINACHOPPER
4 Exploitation

Capability (Malware)

Backdoors Beacon CHINACHOPPER
5 Installation

Capability (Malware)

Backdoors Beacon CHINACHOPPER
6 Command & Control

Capability (Malware)

Backdoors Beacon CHINACHOPPER
7 Actions on Objectives

Capability (Techniques)

T1041 T1048 T1489

Capability (Malware)

Backdoors Beacon CHINACHOPPER
Leaving Threaticon

This link opens an external site that isn't part of the platform.