--- analysis: A simple detection rule on specific registry keys is easily bypassed by rotation. This hunt uses a prevalence-based approach to find rare keys in the Console hive and corroborates them with in-memory script behavior and DNS patterns, which a static rule cannot do. blind_spots: - id: no-endpoint-telemetry question: Can we see modifications to HKCU\Console in real-time? requires: Endpoint telemetry reporting HKCU registry modifications. risk: Registry-based C2 caching would be missed if the agent only monitors HKLM or system-wide keys. stage: c2-registry-caching-and-fingerprinting - id: amsi-script-visibility question: Are in-memory VBScript executions using ExecuteGlobal visible? requires: hb_script_activity (AMSI-sourced telemetry). risk: Without content-level script telemetry, the loader's execution inside legitimate script hosts remains invisible. stage: in-memory-vbscript-execution coverage: - stage: c2-registry-caching-and-fingerprinting status: covered steps: - registry-c2-caching - prevalence-registry-value-names - dns-to-ddr-domains - stage: in-memory-vbscript-execution status: covered steps: - vbscript-in-memory-execution - reason: 'Belongs to another part of the ''FSB Matryoshka: Gamaredon GammaLoad'' series.' stage: persistence-via-ads-and-scheduled-task status: out_of_scope - reason: 'Belongs to another part of the ''FSB Matryoshka: Gamaredon GammaLoad'' series.' stage: obfuscated-powershell-memory-load status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Gamaredon (UAC-0010) is a highly active FSB-operated intrusion set. Detecting their intermediate loaders (GammaLoad) is critical for disrupting their access before they deploy credential-stealing final payloads (GammaSteel). methodology: model-assisted trigger: intel-report hypothesis: An intruder is maintaining stealthy persistence by using VBScript-based loaders (GammaLoad) to cache C2 addresses within the unusual HKCU\Console registry hive and exfiltrating host fingerprints through crafted User-Agent strings. labels: - hunt - attack.t1041 - attack.t1090.003 - attack.t1059.001 - attack.t1053.005 - attack.t1555 name: Gamaredon GammaLoad VBScript & Registry Interaction parameters: ddr_domains: default: - te.legra.ph - telegram.me - check-host.net - trycloudflare.com - workers.dev - huaweicloud.com - selltosell.ru description: Legitimate domains used as Dead Drop Resolvers (DDR) by GammaLoad. from: kind: article observed: '2026-01-23' ref: blog.sekoia.io type: list[domain] gammaload_registry_keys: default: - HistoryURL - WindowsResponby - CloudURL - IpURL description: Registry value names used by GammaLoad for C2 caching in HKCU\Console. from: kind: article observed: '2026-01-23' ref: blog.sekoia.io type: list[string] lookback_days: default: '14' description: Days of history to examine. type: number provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: The hunt scopes to Windows hosts using software inventory. It prioritizes the HKCU registry hive, which requires active endpoint telemetry (e.g., Sysmon or osquery) for full visibility. references: - name: "Sekoia.io \u2014 FSB\u2019s Matryoshka: Gamaredon GammaLoad" url: https://blog.sekoia.io/fsbs-matryoshka-2-3-gamaredons-gifts-that-keeps-unpacking-gammaload/ related: - hunt: gammaload-persistence-ads-scheduled-task reason: This hunt focuses on the initial registry/C2 interaction; persistence via ADS and Scheduled Tasks is handled in the next part of the series. relation: out-of-scope-alternative scenario: stages: - name: C2 Registry Caching and Host Fingerprinting observables: - 'Registry keys: HKCU\Console\HistoryURL, HKCU\Console\WindowsResponby, HKCU\Console\CloudURL, HKCU\Console\IpURL' - 'DDR domains: te.legra.ph, telegram.me, check-host.net' - 'User-Agent fingerprint separators: ##, !!, ??, ==, ::, _, @, #, =, %, ?' - 'HTTP GET requests with anomalous Content-Length: 2114' - 'Fingerprint: %COMPUTERNAME% and system drive serial number' slug: c2-registry-caching-and-fingerprinting tactic: command-and-control techniques: - T1041 - T1090.003 - name: In-Memory VBScript Execution observables: - VBScript ExecuteGlobal() function calls - Base64 obfuscated scripts with '&&' markers inserted every 54 characters slug: in-memory-vbscript-execution tactic: execution techniques: - T1059.001 - name: Persistence via ADS and Scheduled Task observables: - 'Alternate Data Stream (ADS) file: %TEMP%\:divedz0f' - 'Scheduled Task name: \Windows\ApplicationData\DsSvcCleanup' - 'Scheduled Task interval: every 11 minutes' - Task action executing VBScript from ADS slug: persistence-via-ads-and-scheduled-task tactic: persistence techniques: - T1053.005 - name: Obfuscated PowerShell Memory Load observables: - 'Process command line: powershell.exe -nol -nop -encodedcommand' - 'PowerShell disabling SSL validation: [System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true}' - PowerShell XOR-decryption and IEX execution of downloaded strings slug: obfuscated-powershell-memory-load tactic: execution techniques: - T1059.001 summary: Gamaredon uses a multi-stage infection chain known as GammaLoad to maintain persistent access and deploy stealers. The chain leverages VBScript loaders that use Dead Drop Resolvers and registry caching for C2 resiliency, ultimately persisting via scheduled tasks that execute payloads hidden in Alternate Data Streams (ADS). series: index: 1 slug: fsb-matryoshka-gamaredon-gammaload title: 'FSB Matryoshka: Gamaredon GammaLoad' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Gamaredon GammaLoad VBScript & Registry Interaction This hunt targets the 'GammaLoad' stage of Gamaredon (FSB-linked) operations, focusing on their unique method of using the Windows Console registry hive (HKCU\Console) to persist C2 configurations. It identifies hosts where these specific registry values are created, uses prevalence to highlight rare registry entries, and corroborates the findings against in-memory VBScript execution patterns and network activity targeting legitimate Dead Drop Resolvers (DDR). ## scope-to-windows-hosts Identify potential targets by finding Windows systems that have PowerShell installed, as the loaders heavily utilize script-based execution. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hostnames representing the Windows fleet. Silence means no systems matching the OS/software inventory criteria were found. reads: - device_hostname - package_name - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-09' ~~~ SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%powershell%' OR LOWER(vendor_name) LIKE '%microsoft%' ``` ## registry-c2-caching Find registry modifications where the HKCU\Console hive is used to store URL-like data in GammaLoad-specific keys. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, gammaload_registry_keys=gammaload_registry_keys) ~~~yaml expected: Value names like 'HistoryURL' or 'CloudURL' appearing under the Console key, containing URLs. This is a strong behavioral match for GammaLoad. reads: - device_hostname - actor_user_name - reg_target - reg_value_data - reg_value_name - time silence: not_evidence_of_absence source: hb_registry_activity verified: dry-run verified_at: '2026-09-09' ~~~ SELECT device_hostname, actor_user_name, reg_target, reg_value_data, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\console\\%' AND (instr(',' || '{{gammaload_registry_keys}}' || ',', ',' || reg_value_name || ',') > 0 OR LOWER(reg_value_data) LIKE 'http%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## prevalence-registry-value-names Stack-count the value names created in the HKCU\Console path across the fleet to highlight unique persistence keys. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A list of registry value names appearing on only a handful of hosts. Genuine terminal settings will appear fleet-wide. prevalence: by: device_hostname key: - reg_value_name rare_below: 3 reads: - reg_value_name - device_hostname - time silence: not_evidence_of_absence source: hb_registry_activity verified: dry-run verified_at: '2026-09-09' ~~~ SELECT reg_value_name, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\console\\%' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY reg_value_name HAVING host_count <= 3 ORDER BY host_count ASC ``` ## parallel-corroboration parallel: - → vbscript-in-memory-execution - → dns-to-ddr-domains join: → triage-agent ## vbscript-in-memory-execution Identify VBScript blocks using ExecuteGlobal() with GammaLoad-specific obfuscation ('&&' every 54 characters). ```sqlite target=endpoint role=triage params=(lookback_days=lookback_days) ~~~yaml expected: Script blocks containing ExecuteGlobal and the '&&' pattern or references to Console registry keys. reads: - device_hostname - actor_user_name - script_content - time silence: not_evidence_of_absence source: hb_script_activity verified: dry-run verified_at: '2026-09-09' ~~~ SELECT device_hostname, actor_user_name, script_content, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%executeglobal%' AND (LOWER(script_content) LIKE '%&&%' OR LOWER(script_content) LIKE '%console%')) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## dns-to-ddr-domains Confirm if the hosts identified in the registry or script steps are communicating with known Gamaredon DDR services. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, ddr_domains=ddr_domains) ~~~yaml expected: DNS queries for Telegraph, Telegram API, or cloudflare workers occurring on the same hosts as registry anomalies. reads: - device_hostname - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-09' ~~~ SELECT device_hostname, query_hostname, COUNT(*) AS count, MIN(time) AS first_seen FROM hb_dns_activity WHERE instr(',' || '{{ddr_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ``` ## triage-agent ```agent target=hunter cite: required context: - registry-c2-caching - prevalence-registry-value-names - vbscript-in-memory-execution - dns-to-ddr-domains max_iterations: 6 objective: Determine if the observed HKCU\Console registry activity, obfuscated VBScript execution, and DDR-related DNS queries represent a unified GammaLoad infection pattern. success_criteria: A per-host verdict (Malicious | Suspicious | Benign) with specific citations for the registry keys used and the scripts executed. tools: - endpoint ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: no-endpoint-telemetry) else: → close-out ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host and remove the malicious HKCU\Console registry keys identified by the triage agent. ``` → analyst-review ## analyst-review ```manual target=analyst Review the correlated registry, script, and DNS telemetry. Check for file creations in %TEMP% (specifically ADS) which might indicate the next stage (GammaSteel). ``` → end ## close-out ```manual target=analyst No indicators of GammaLoad were found. Document the lookback period and domains examined. ``` → end