--- analysis: A simple detection rule might fire on encoded PowerShell. This hunt is superior because it correlates those behaviors with unique registry failover logic and DDR network patterns, providing a multi-surface view that identifies the persistent configuration used by the actor that static rules often miss. blind_spots: - id: visibility-gap question: whether GammaLoad has established persistence on hosts that do not report registry telemetry requires: endpoint agent reporting on the registry surface risk: A host with registry persistence but no active agent reporting will not be identified, leaving a persistent foothold for the adversary. stage: gammaload-vbs-discovery-c2 - id: ads-telemetry-truncation question: whether the execution of an Alternate Data Stream is correctly logged by the endpoint telemetry provider requires: hb_scheduled_job reporting full ADS paths risk: If the agent truncates the colon in the path or fails to report ADS execution within the task command line, the primary persistence mechanism remains invisible. stage: gammaload-persistence-ads coverage: - stage: gammaload-vbs-discovery-c2 status: covered steps: - gammaload-registry-c2 - gammaload-dns-ddr - stage: gammaload-persistence-ads status: covered steps: - gammaload-persistence-task - stage: gammaload-powershell-loader status: covered steps: - gammaload-persistence-task - triage-agent guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: GammaLoad is the bridge between initial access and final payload delivery for Gamaredon. Detecting this stage allows for containment before espionage tools like GammaSteel are deployed. A negative result provides confidence that the environment is not staged for FSB-backed espionage. methodology: model-assisted trigger: intel-report hypothesis: An intruder has established persistent access using GammaLoad VBScripts that manage C2 configuration via registry keys in HKCU\Console and execute via a high-frequency task invoking an Alternate Data Stream. labels: - hunt - attack.t1059.001 - attack.t1090.003 - attack.t1053.005 - attack.t1041 name: Gamaredon GammaLoad Multi-stage Persistence and Execution parameters: ddr_domains: default: - te.legra.ph - telegram.me - check-host.net - www.huaweicloud.com - yggjf81487.workers.dev - selltosell.ru - trycloudflare.com - csxvl00328.workers.dev - dayobtvoyu.ru description: Dead Drop Resolver and staging domains identified in the report. from: kind: article observed: '2026-01-23' ref: Sekoia GammaLoad type: list[domain] lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-01-23' ref: standard-lookback type: number scope_hosts: default: [] description: Optional list of hostnames to focus the hunt; leave empty for fleet-wide. from: kind: manual observed: '2026-01-23' ref: analyst-scoping type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: This hunt targets the Windows fleet, where GammaLoad registry and task mechanisms operate. Focus first on workstations with direct internet access, as they are the primary targets for initial access and DDR-based C2 discovery. references: - name: "Sekoia.io \u2014 FSB Matryoshka: Gamaredon GammaLoad" url: https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/ related: - hunt: gamaredon-gammasteel-stealer-detection reason: GammaLoad is the delivery mechanism for the GammaSteel stealer analyzed in the next stage of the attack chain. relation: follows scenario: stages: - name: VBScript Host Fingerprinting and C2 Discovery observables: - 'Registry keys: HKCU\Console\HistoryURL, HKCU\Console\WindowsResponby, HKCU\Console\CloudURL, HKCU\Console\IpURL' - 'Domains: te.legra.ph, telegram.me, check-host.net' - 'User-Agent separators: ##, !!, ??, ==, ::' - 'Anomalous HTTP GET request with Content-Length: 2114' - VBScript ExecuteGlobal() function - Fingerprinting of %COMPUTERNAME% and system drive serial number slug: gammaload-vbs-discovery-c2 tactic: discovery techniques: - T1059.001 - T1090.003 - T1041 - name: Persistence via Scheduled Task and ADS observables: - 'File path: %TEMP%\:divedz0f (Alternate Data Stream)' - 'Scheduled task name: \Windows\ApplicationData\DsSvcCleanup' - 'Task frequency: every 11 minutes' - 'Domain: dayobtvoyu.ru' slug: gammaload-persistence-ads tactic: persistence techniques: - T1053.005 - name: Encoded PowerShell In-Memory Loader observables: - 'Process command: powershell.exe -nol -nop -encodedcommand' - 'Script method: [System.Net.ServicePointManager]::ServerCertificateValidationCallback' - 'Script method: $webClient.DownloadString' - XOR-decryption of downloaded payload - Execution of payload in-memory slug: gammaload-powershell-loader tactic: execution techniques: - T1059.001 summary: Gamaredon (UAC-0010) uses the GammaLoad toolset, a multi-stage infection chain consisting of VBScript and PowerShell loaders. The malware fingerprints hosts, resolves C2 infrastructure via legitimate dead-drop services like Telegram and Telegraph, and maintains persistence using scheduled tasks that execute code stored in NTFS Alternate Data Streams. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Gamaredon GammaLoad Multi-stage Persistence and Execution GammaLoad is a modular VBScript loader used by Gamaredon (UAC-0010) for persistence and staging. It uses a failover mechanism for C2 discovery, storing active URLs in the Windows registry under HKCU\Console and using Dead Drop Resolvers (DDR) such as Telegraph and Telegram. This hunt identifies specific registry artifacts, correlates them with DNS requests to staging domains, and detects the 11-minute scheduled task used to launch a third-stage PowerShell loader from an Alternate Data Stream. By fanning out across registry, persistence, and network surfaces, the hunt provides a complete view of the GammaLoad infection chain that evades simple detection rules. ## scope-windows-hosts Identify active Windows assets in the environment as the primary targets for GammaLoad. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days) ~~~yaml expected: A list of Windows hostnames active within the window. Silence indicates no Windows hosts are enrolled or active, limiting the scope of this hunt. reads: - hostname - platform - time silence: not_evidence_of_absence source: hb_devices verified: dry-run verified_at: '2026-09-21' ~~~ SELECT DISTINCT hostname AS device_hostname FROM hb_devices WHERE LOWER(platform) = 'windows' AND time >= datetime('now', '-{{lookback_days}} days') ``` ## fan-out-corroboration parallel: - → gammaload-registry-c2 - → gammaload-persistence-task - → gammaload-dns-ddr join: → triage-agent ## gammaload-registry-c2 Identify hosts where GammaLoad has cached its active C2 infrastructure in HKCU\Console keys. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Hosts with URL or IP address strings stored in the Console registry keys. Silence suggests no registry-based C2 caching occurred in the window. reads: - device_hostname - reg_target - reg_value_data - time silence: not_evidence_of_absence source: hb_registry_activity verified: dry-run verified_at: '2026-09-21' ~~~ SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\console\%' AND (LOWER(reg_value_data) LIKE 'http%' OR reg_value_data GLOB '*[0-9].[0-9]*') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## gammaload-persistence-task Detect the high-frequency scheduled task used to execute the GammaLoad payload from an Alternate Data Stream. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A scheduled task executing from a Temp path ADS or a script interpreter targeting the Temp directory. Silence provides evidence of absence for this specific persistence mechanism. prevalence: by: device_hostname key: - job_cmd_line rare_below: 3 reads: - device_hostname - job_cmd_line - time silence: evidence_of_absence source: hb_scheduled_job verified: dry-run verified_at: '2026-09-21' ~~~ SELECT device_hostname, job_cmd_line, time FROM hb_scheduled_job WHERE (LOWER(job_cmd_line) LIKE '%\temp\:%' OR ((LOWER(job_cmd_line) LIKE '%cscript%' OR LOWER(job_cmd_line) LIKE '%wscript%') AND LOWER(job_cmd_line) LIKE '%\temp\%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## gammaload-dns-ddr Identify network resolution of the legitimate services abused by GammaLoad for C2 discovery. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, ddr_domains=ddr_domains, scope_hosts=scope_hosts) ~~~yaml expected: DNS requests to Telegraph, Telegram, or Check-Host on the same hosts exhibiting registry or task persistence. Silence suggests no resolution of known DDR domains. reads: - device_hostname - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-21' ~~~ SELECT device_hostname, query_hostname, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{ddr_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ``` ## triage-agent ```agent target=hunter cite: required context: - gammaload-registry-c2 - gammaload-persistence-task - gammaload-dns-ddr max_iterations: 5 objective: Correlate registry C2 storage, high-frequency scheduled tasks using Alternate Data Streams, and DNS resolution of Dead Drop domains to confirm active GammaLoad infection. success_criteria: A verdict of malicious | suspicious | benign for each host, citing specific registry values and task command lines. tools: - endpoint ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → forensic-review unavailable: → forensic-review (blind_spot: visibility-gap) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host and prepare for forensic evidence collection. ``` → forensic-review ## forensic-review ```manual target=analyst Collect the ADS content from %TEMP%\:divedz0f and extract the C2 URLs from the HKCU\Console keys. Inspect script logs for any XOR-decrypted final payloads. ``` → close-out ## close-out ```manual target=analyst Record which hosts were impacted and the specific C2 indicators observed. Recommend promoting the HKCU\Console URL storage query to a standing detection rule. ``` → end