Resubmissions
11/11/2026, 02:18
261111-crd1xadt6p1011/11/2026, 02:14
261111-cn8q4set4x1011/11/2026, 01:54
261111-cb2f9sts2r1008/09/2026, 17:42
260908-v91lqsvzby1008/09/2026, 14:47
260908-r5xshastaw06/09/2026, 10:46
260906-mtz19shn5s1002/09/2026, 16:53
260902-vefcbaxhjb1002/09/2026, 16:53
260902-vd1xmaxgqd26/04/2026, 11:25
260426-njgydaas6r1024/04/2026, 20:04
260424-ys8gssbv3l10Analysis
- max time kernel
120s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-es - resource tags
- submitted
11/11/2026, 01:54
General
- Target Ransomware/DeriaLock.exe
- Size 484KB
- Sample261111-cb2f9sts2r
- SHA256 4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware\DeriaLock.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware\DeriaLock.exe"1⤵
- Creates a file in the Startup directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ApproveRestart.vsd.deria
BlockResize.aifc.deria
CheckpointShow.dotx.deria
memory/5504-8-0x0000000009300000-0x0000000009402000-memory.dmp
memory/5504-10-0x0000000074782000-0x0000000074783000-memory.dmp
memory/5504-5-0x00000000053C0000-0x00000000053CA000-memory.dmp
memory/5504-6-0x0000000005580000-0x00000000055D6000-memory.dmp
memory/5504-7-0x0000000074770000-0x0000000074F2C000-memory.dmp
memory/5504-0-0x0000000074782000-0x0000000074783000-memory.dmp
memory/5504-9-0x00000000099D0000-0x0000000009A10000-memory.dmp
memory/5504-4-0x00000000054E0000-0x0000000005572000-memory.dmp
memory/5504-11-0x0000000074770000-0x0000000074F2C000-memory.dmp
memory/5504-12-0x0000000009BE0000-0x0000000009D6C000-memory.dmp
memory/5504-13-0x0000000074770000-0x0000000074F2C000-memory.dmp
memory/5504-3-0x0000000005AA0000-0x000000000605A000-memory.dmp
memory/5504-2-0x0000000005440000-0x00000000054DC000-memory.dmp
memory/5504-1-0x0000000000950000-0x00000000009D2000-memory.dmp
memory/5504-158-0x0000000074770000-0x0000000074F2C000-memory.dmp