Conti is a ransomware-as-a-service operation. Affiliates frequently receive access that earlier loaders such as Trickbot or BazarLoader already established, so the ransomware tends to arrive late in an intrusion.
Switches
The sample accepts a few arguments that change what it targets.
-p path or share to process
-m mode selector (local / network)
-size size handling for large files
Evasion inside the binary
Most of the effort goes into making the file hard to look at.
- Encrypted entry point. The program starts with a decryption stub, so the real code only exists in memory after a few instructions have run.
- API names hidden. Function names are decrypted just in time, resolved, then the same loop re-encrypts the strings. A memory scan at the wrong moment sees nothing useful.
- Emulator trap. A very long loop sits in front of the interesting code to burn through the instruction budget of lightweight AV emulators.
- Variants differ mainly in how the API-name decryption is written, which is why signatures for one build miss the next.
Backups and injection
Shadow copies are removed through WMI so file recovery from the disk is not possible. The malware then walks the process list with a toolhelp snapshot, looks for explorer.exe by comparing against a hard-coded string, and injects the ransomware payload there.
CreateToolhelp32Snapshot
for each process:
compare name with "explorer.exe"
match -> inject payload into that process
Ransom note
The note announces that the data is encrypted by Conti, offers a free test decryption of a couple of files, and threatens to publish data already copied from the victim. Contact is through a Tor site using a per-victim identifier.
Defensive takeaways
- Injection into explorer.exe from a non-standard parent is a strong signal.
- Shadow copy removal via WMI belongs on every detection list.
- Because Conti follows other loaders, catching the earlier stage is usually the better opportunity.