Analysis of Conti Ransomware Attack on Computer Network with Live Forensic Method

Abstract

Ransomware viruses have become a dangerous threat increasing rapidly in recent years. One of the variants is Conti ransomware that can spread infection and encrypt data simultaneously. Attacks become a severe threat and damage the system, namely by encrypting data on the victim's computer, spreading it to other computers on the same computer network, and demanding a ransom. The working principle of this Ransomware acts by utilizing Registry Query, which covers all forms of behavior in accessing, deleting, creating, manipulating data, and communicating with C2 (Command and Control) servers. This study analyzes the Conti virus attack through a network forensic process based on network behavior logs. The research process consists of three stages, the first stage is simulating attacks on the host computer, the second stage is carrying network forensics by using live forensics methods, and the third stage is analysing malware by using statistical and dynamic analysis. The results of this study provide forensic data and virus behavior when running on RAM and computer networks so that the data obtained makes it possible to identify ransomware traffic on the network and deal with zero-day, especially ransomware threats. It is possible to do so because the analysis is an initial step in generating virus signatures based on network indicators.

Securing IoT Devices Running PureOS from Ransomware Attacks: Leveraging Hybrid Machine Learning Techniques

“…ix. The Conti [33] ransomware is a highly advanced and complex malware that uses a sophisticated encryption algorithm to encrypt files on a victim's computer system. It can spread through a network, infecting other connected systems.…”

Forensik Serangan Ransomware Ryuk pada Jaringan Cloud

“…Suatu jaringan dapat diketahui sedang diserang atau telah diserang melalui log yang mencatat aktivitas komputer. Log berperan penting sebagai penunjang dalam proses investigasi khususnya forensik jaringan [14].…”

An Analysis of Conti Ransomware Leaked Source Codes

“…To the best of our knowledge, there is only one academic paper about the Conti ransomware. In [21], the authors focus on preliminarily static analysis and primary behavior analysis of the ransomware on a computer network. They use a 2021 sample of the Conti ransomware.…”

“…The source code also shows API hashing techniques and dynamic API loading. In [21], the network behavior analysis shows how Conti ransomware can spread and encrypt networks file. This study lake some critical information about the Conti ransomware, such as all its libraries, API calls, API hashing algorithm, encryption flow, and encryption algorithm.…”