Andromeda Bot - UNC4210 Lab

Analyze memory images and event logs using MemProcFS, EvtxECmd, and Timeline Explorer to identify Andromeda bot IOCs, reconstruct its infection timeline, and attribute it to an APT group.

Category:

Endpoint Forensics

Tactics:

Initial Access Persistence Privilege Escalation Stealth Lateral Movement Command and Control

Tools:

MemProcFS VirusTotal Evtxcmd Timeline Explorer

medium

Walkthrough Available

1hr

Sign in to Download Lab Files

Unlock Your Full Learning Experience with CyberRange Labs

Sign up to track your progress, unlock exclusive labs, and showcase your achievements—begin your journey now!