Delphos Lantern scores #1 on BinaryAudit backdoor detection: by mean, peak, floor, and reproducibilityLearn more
Ransomware

Conti ransomware analysis: service-killing encryptor with network share targeting

DestructiveDiscoveryDefense evasionExecutionAnti-Analysis

PE · Oct 8, 2026

Verdict:Malicious
Confidence:High
conti_sample is a ransomware executable. Static analysis with complete code coverage showed a reachable end-to-end workflow that (1) enumerates local drives and network-accessible paths, (2) writes a ransom note named HOW_TO_DECRYPT.txt, (3) processes files with a CryptoAPI-backed encryption worker and renames them with the .CONTI extension, and (4) runs hidden system commands to stop security and backup-related services before or during encryption. Immediate implication: this sample is consistent with Conti-family ransomware behavior and should be treated as destructive malware capable of broad file impact on local and shared storage.

Scope and Coverage

  • Root artifact examined: /workspace/conti_sample
  • Type: PE32 x86 Windows GUI executable
  • SHA-256: 94bdec109405050d31c2748fe3db32a357f554a441e0eae0af015e8b6461553e
  • Static coverage: complete
    • 31,975 / 31,975 executable bytes attributed
    • 21 recovered functions
    • 0 unattributed regions
  • Dynamic analysis: not performed
  • String coverage: plaintext string extraction plus targeted hidden-string recovery The verdict does not depend on reputation alone or on missing strings. Plaintext extraction did not surface some high-value service-stop strings, so I performed a decode attempt on XOR-obfuscated blobs recovered from code and successfully recovered the hidden commands.

Artifact Relationships and Behavioral Sequence

This is a single-file native payload; the main behavioral chain is:
  1. Entry point _start (0x402610)
      • Loads two embedded RCDATA resources with FindResourceA / LoadResource / LockResource.
      • Converts one resource from multibyte text to UTF-16 with MultiByteToWideChar.
      • Initializes worker state and dispatch structures.
      • Calls drive and network-path enumeration routines, then feeds discovered paths to the recursive walker sub_407fe0.
  1. Path recursion / targeting in sub_407fe0 (0x407fe0)
      • Writes a ransom note file named HOW_TO_DECRYPT.txt in traversed directories.
      • Recurses into directories while excluding selected system paths.
      • Skips files already ending in .CONTI and the ransom note itself.
      • Filters some extensions (.exe, .dll, .lnk, .sys) and system directories such as Windows, Boot, Program Files, Program Files (x86), System Volume Information, $Recycle.Bin, AppData, and Application Data.
      • Queues candidate files to sub_408ca0 for worker processing.
  1. Worker dispatch in sub_408ca0 (0x408ca0)
      • Allocates a work item, stores the target path, and posts it to a worker mechanism via data_40ce2c(...).
  1. File processing in sub_408830 (0x408830)
      • Acquires the Windows provider strings:
        • Microsoft Enhanced RSA and AES Cryptographic Provider (0x409950)
        • Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype) (0x409988)
      • Opens target files, processes them in chunks up to 0x500000, writes transformed output back, and finally renames each processed file by appending .CONTI.
  1. Command execution helper in sub_402b60 (0x402b60)
      • Executes command lines with CreateProcessA(..., CREATE_NO_WINDOW, ...) and waits for completion.
      • This helper is called from routines containing XOR-obfuscated command blobs.

Key Findings

1. Reachable ransom-note deployment

Evidence: sub_407fe0 (0x407fe0) This function constructs directory-local paths and creates a file named HOW_TO_DECRYPT.txt using the embedded note data previously staged from resources:
  • note filename string at 0x4097ac
  • note write path built in sub_407fe0
  • note contents written through data_40cdc8(...) using global note pointers set by sub_407fa0 This is ransomware-specific behavior, not generic file encryption.

2. Reachable file encryption and .CONTI renaming

Evidence: sub_408830 (0x408830) sub_408830:
  • acquires an AES-capable CryptoAPI provider,
  • reads and writes file data in a loop,
  • and renames the processed file by appending .CONTI. Relevant code-backed details:
  • Crypto provider strings at 0x409950 and 0x409988
  • encrypted-extension string .CONTI at 0x409900
  • rename operation via MoveFileW(edi_3, eax_29) after appending .CONTI That combination is direct evidence of ransomware file-impact behavior.

3. Hidden pre-encryption commands stop protections and related services

Evidence: XOR-obfuscated strings decoded from data blobs referenced by command-launching routines Plaintext strings alone did not reveal these commands, so I decoded XOR-0x99 blobs extracted from the binary. Examples:
  • Blob at 0x40bba0 decodes to:
      • cmd.exe /c net stop "Sophos Agent" /y
  • Blob at 0x40b5d4 decodes to:
      • cmd.exe /c net stop "Acronis VSSProvider" /y
  • Blob at 0x40ac60 decodes to:
      • cmd.exe /c net stop "Enterprise Client Service" /y
  • Additional decoded commands from sub_4032a0 data include stopping:
    • SophosAutoUpdate Service (0x40a5a8)
    • SophosClean Service (0x40b288)
    • SophosDeviceControl Service (0x40a268)
    • SophosHealth Service (0x40bbec)
    • SMCS Agent (0x40b488)
    • SMCS Client (0x40a000) These commands are executed through sub_402b60, which wraps CreateProcessA with CREATE_NO_WINDOW. Their role is consistent with disabling endpoint protection and backup-related components to improve encryption success.

4. Local-drive and network-path traversal broaden impact

Evidence: sub_4024b0, sub_402990, sub_402900, sub_402800, and _start
  • sub_4024b0 builds a list of local drives and retains specific drive types for later processing.
  • _start iterates that list and sends each root to sub_407fe0.
  • sub_402990 converts discovered addresses with InetNtopW, stores them, launches 32 threads, and waits on them.
  • sub_402800 formats UNC-style paths with "\\%s\\" (0x4093cc) and appends discovered share names. This is consistent with encrypting not only local files but also reachable network shares or remote paths.

5. Targeting logic excludes some system-critical paths while preserving data impact

Evidence: sub_407fe0 strings and comparisons sub_407fe0 explicitly checks for and skips paths/names including:
  • Windows (0x4098f0)
  • Boot (0x4098e4)
  • Program Files (0x4098a0)
  • Program Files (x86) (0x4098bc)
  • System Volume Information (0x40986c)
  • $Recycle.Bin (0x409834) / $RECYCLE.BIN (0x409850)
  • AppData (0x40980c)
  • Application Data (0x4097e8) It also avoids reprocessing:
  • .CONTI (0x409900)
  • HOW_TO_DECRYPT.txt (0x4097ac) This is typical ransomware tradecraft: avoid destabilizing the host too early while maximizing recoverable victim data impact.

Indicators

File / family indicators

  • SHA-256: 94bdec109405050d31c2748fe3db32a357f554a441e0eae0af015e8b6461553e
  • Added extension: .CONTI
  • Ransom note filename: HOW_TO_DECRYPT.txt

Decoded command indicators

  • cmd.exe /c net stop "Sophos Agent" /y
  • cmd.exe /c net stop "Acronis VSSProvider" /y
  • cmd.exe /c net stop "Enterprise Client Service" /y
  • cmd.exe /c net stop "SophosAutoUpdate Service" /y
  • cmd.exe /c net stop "SophosClean Service" /y
  • cmd.exe /c net stop "SophosDeviceControl Service" /y
  • cmd.exe /c net stop "SophosHealth Service" /y
  • cmd.exe /c net stop "SMCS Agent" /y
  • cmd.exe /c net stop "SMCS Client" /y

Alternative Explanations and Contrary Evidence

Considered alternative: legitimate file-encryption or backup software

I considered whether this could be a legitimate encryptor or administration utility. That explanation does not fit the observed behavior because the same reachable code path combines:
  • a ransom-note filename (HOW_TO_DECRYPT.txt),
  • file renaming to .CONTI
  • recursive traversal of local and network paths,
  • exclusion logic aimed at preserving host operability while targeting data,
  • and hidden commands that stop AV / backup-related services. A legitimate encryptor would need a credible benign purpose for all of those behaviors together. The sample provides none.

Unknowns

These gaps do not materially change the verdict, but they limit some detail:
  • I did not fully extract the embedded ransom-note body from the RCDATA resource; however, the code demonstrably writes a note file with that name and uses resource-backed note content.
  • I did not run the sample dynamically, so this report does not claim which exact paths or services would succeed in a specific environment.
  • I did not establish any internet-facing C2 path; that question was not necessary for classification because the destructive ransomware workflow is already directly evidenced.

Verdict Rationale

The sample is malicious because the main reachable execution path directly supports ransomware behavior:
  • _start initializes resources and traversal,
  • sub_407fe0 walks paths and writes HOW_TO_DECRYPT.txt
  • sub_408830 performs CryptoAPI-backed file transformation and renames outputs to .CONTI
  • and separate hidden command sequences executed via sub_402b60 stop security and backup-related services. This is sufficient for a malicious verdict even without dynamic execution. The evidence is code-backed, internally consistent, and comes from complete static coverage of the executable regions.

About Delphos Labs Analysis

The Delphos platform analyzes compiled binaries directly and produces structured behavioral intelligence reports within minutes. This lets analysts understand what a binary does without manual analysis.

Request Access
Back to all reports