Conti Ransomware Source Code Analysis: Deep Dive into Encryption and Evasion Techniques

• 0:00:13 Introduction and Setup:
  • The source code, obtained from VX Undergrounds, is explored using Visual Studio 2022 with C++ desktop resources.
  • The analysis focuses on the crypto portion of the Conti ransomware.
  • The source code had already been leaked prior to this analysis.
• 0:00:32 Key Concepts:
  • Ransomware encrypts files, and Conti uses Chacha20 for symmetric encryption.
  • The code includes techniques for multi-threading, cryptography, and EDR evasion (unhooking).
• 0:02:04 Entry Point and Functionality:
  • The entry point is WinMain, and the code is organized into folders for different functionalities (anti-hooking, API, crypter, etc.).
  • The analysis will follow the entry point and explore each function's role.
• 0:05:30 API Hashing and EDR Unhooking:
  • GetApiModule function retrieves the address of kernel32.dll by iterating through the PEB module list and hashing module names.
  • API hashing is used to avoid detection by hiding imported functions.
  • Unhook function removes EDR hooks from loaded DLLs by mapping the file from disk, comparing with the in-memory version, and restoring the original code.
  • Unhooking iterates through the export address table (EAT) of a given DLL, checking for and removing any jump instructions (E9 for relative jump and FF 25 for an absolute jump) that are indicative of API hooks.
• 0:08:03 Loading Dependencies:
  • The LoadLibrary function is used to load necessary DLLs like kernel32.dll, ws2_32.dll, etc.
• 0:09:09 API Hooking Mechanism:
  • EDRs hook API functions by replacing the original function stub with a jump to their own code for analysis.
• 0:10:03 Unhooking Process:
  • The Unhook function gets the module file name, creates a file mapping, parses the PE headers, iterates through exported functions, and restores the original code if a hook is detected.
• 0:22:01 Command Line Handling:
  • The code handles command line arguments for different encryption modes (path, lock file, etc.).
• 0:29:31 Mutex for Single Instance:
  • A mutex is used to ensure that only one instance of the ransomware runs at a time.
• 0:30:53 Thread Pool for Encryption:
  • A thread pool is created to handle concurrent file encryption.
  • Each thread processes tasks from a queue, and a stop signal is used for synchronization.
• 0:36:42 Cryptographic Operations:
  • The code initializes a crypto provider, imports a public key, generates a symmetric key, and encrypts files using Chacha20.
  • The symmetric key is encrypted with the public key and appended to the encrypted file.
• 0:43:41 File Encryption Process:
  • The code enumerates files in a directory, checks for blacklisted directories and file types, and encrypts files based on their type and size.
• 0:50:57 Network Share Enumeration:
  • The code scans for network shares and adds them to a list for encryption.
• 1:03:10 Process Killer:
  • A process killer terminates processes that might interfere with encryption.
• 1:04:03 Shadow Copy Deletion:
  • The code uses WMI to delete shadow copies, preventing file recovery.
• 1:21:32 Partial File Encryption:
  • For virtual machine disk files (VMDK, VHD, etc.), the ransomware encrypts only a portion (e.g., 20%) to save time while still rendering the VM unusable.
  • For other files, it employs different strategies based on file size: full encryption for files smaller than 1MB, header-only encryption for files between 1MB and 5MB, and 50% encryption for files larger than 5MB.
• 1:29:30 Discussion of Evasion Techniques:
  • The unhooking technique is considered inefficient.
  • Running the ransomware before EDR drivers load (using boot execute) is discussed as a potential evasion method.
• 1:45:14 Discussion on Detection Methods:
  • Using canary files (hidden files that should not be modified) to detect ransomware activity is discussed.
  • Monitoring the USN journal for unusual file access patterns is mentioned as a potential detection technique.
• 1:49:24 Speculation on Conti's Reaction to the Leak:
  • The leak was likely the result of a disgruntled developer.
• 1:55:10 Code Quality Discussion:
  • The code quality is considered poor, but it is functional.
• 2:02:29 Closing Remarks:
  • The analysis provides valuable insights into the inner workings of ransomware.
  • The importance of using established cryptographic libraries instead of implementing custom crypto is emphasized.
  • The use of compile-time string obfuscation as an anti-analysis technique is discussed.
  • The efficiency of unhooking individual functions versus replacing entire memory sections (e.g., the .text section) to remove hooks is debated.
  • The use of a thread pool to manage concurrent file encryption tasks is highlighted.
  • The strategy of encrypting only portions of large files (like virtual machine disks) to save time while still achieving the goal of data denial is noted.
  • The potential use of the USN journal for detecting ransomware activity by monitoring file access patterns is mentioned.
  • The importance of proper error handling and the use of GetFileSizeEx instead of GetFileSize to avoid issues with large files is pointed out.
  • The irony of using copy-pasted, poorly documented code snippets (like the COM initialization for WMI access) in a complex piece of malware is highlighted.
  • The discussion touches upon the ethics and motivations behind analyzing leaked ransomware source code.
  • The session concludes with an invitation for further discussion and analysis of other malware samples.