Malware analysis DeriaLock.exe Malicious activity | ANY.RUN

Add for printing

File name:	DeriaLock.exe
Full analysis:	https://app.any.run/tasks/d739259c-3514-4c94-89c3-524c37016485
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. Malware Trends Tracker >>>
Analysis date:	May 16, 2025, 16:19:10
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	ransomware loader
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections
MD5:	0A7B70EFBA0AA93D4BC0857B87AC2FCB
SHA1:	01A6C963B2F5F36FF21A1043587DCF921AE5F5CD
SHA256:	4F5BFF64160044D9A769AB277FF85BA954E2A2E182C6DA4D0672790CF1D48309
SSDEEP:	6144:lqHKx3YCgy8HmmjJpnVhvLqCO3bLinIz1wASxQ:lqHoyHNj/nVhvLcyIIQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: on
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- RANSOMWARE has been detected
  - DeriaLock.exe (PID: 7572)
SUSPICIOUS
- Process requests binary or script from the Internet
  - DeriaLock.exe (PID: 7572)
INFO
- Checks supported languages
  - DeriaLock.exe (PID: 7572)
- Reads the machine GUID from the registry
  - DeriaLock.exe (PID: 7572)
- Reads the computer name
  - DeriaLock.exe (PID: 7572)
- Creates files or folders in the user directory
  - DeriaLock.exe (PID: 7572)
- Disables trace logs
  - DeriaLock.exe (PID: 7572)
- Checks proxy server information
  - DeriaLock.exe (PID: 7572)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Generic CIL Executable (.NET, Mono, etc.) (55.8)
.exe	\|	Win64 Executable (generic) (21)
.scr	\|	Windows screen saver (9.9)
.dll	\|	Win32 Dynamic Link Library (generic) (5)
.exe	\|	Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2016:12:26 08:58:11+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	11
CodeSize:	321024
InitializedDataSize:	173568
UninitializedDataSize:	-
EntryPoint:	0x5057e
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI
FileVersionNumber:	1.1.1.1
ProductVersionNumber:	1.1.1.1
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	Generator
CompanyName:	Microsoft
FileDescription:	Generator
FileVersion:	1.1.1.1
InternalName:	LOGON.exe
LegalCopyright:	Copyright © 2016
LegalTrademarks:	Microsoft
OriginalFileName:	LOGON.exe
ProductName:	Generator
ProductVersion:	1.1.1.1
AssemblyVersion:	1.1.1.1

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

131

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

7464

"C:\Users\admin\AppData\Local\Temp\DeriaLock.exe"

C:\Users\admin\AppData\Local\Temp\DeriaLock.exe

—

explorer.exe

User:

admin

Company:

Microsoft

Integrity Level:

MEDIUM

Description:

Generator

Exit code:

3221226540

Version:

1.1.1.1

Modules

Images
c:\users\admin\appdata\local\temp\derialock.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

7572

"C:\Users\admin\AppData\Local\Temp\DeriaLock.exe"

C:\Users\admin\AppData\Local\Temp\DeriaLock.exe

explorer.exe

User:

admin

Company:

Microsoft

Integrity Level:

HIGH

Description:

Generator

Version:

1.1.1.1

Modules

Images
c:\users\admin\appdata\local\temp\derialock.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

7696

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

7744

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

—

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

8144

"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Search application

Exit code:

2147945463

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll

Add for printing

Total events

845

Read events

831

Write events

Delete events

Modification events


(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASMANCS
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(7572) DeriaLock.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DeriaLock_RASMANCS
Operation:	write	Name:	EnableConsoleTracing
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7572	DeriaLock.exe	C:\Users\admin\Documents\floordc.rtf.deria		binary
		MD5:344BC86A26DFCFE01A8D12812B0924DE	SHA256:72A6627605906D68BB4ED38E7086A4B83E1A4E9650D823C8A3DA760E9030B546
7572	DeriaLock.exe	C:\Users\admin\Documents\agreeelectronics.rtf.deria		binary
		MD5:9D7FEF03DD8DC878F6423FD9597F0808	SHA256:1008A2C76A3FD51126B66670C7593047D297CA2F8590BFC8F34AC787F8B2C8AF
7572	DeriaLock.exe	C:\Users\admin\Documents\storysections.rtf.deria		binary
		MD5:A7BF2E957D2D65220396F678FE28AF94	SHA256:A935816E7EE7DDD3942129525BE8591DC4CE63DC53F7862CE854A45E6BAC6A4B
7572	DeriaLock.exe	C:\Users\admin\Documents\desktop.ini.deria		binary
		MD5:56544FF9A9A659E62E4FBACD214606F5	SHA256:4E80BF07432C5E6C9D9FF2112B6DD8D5705C4261B724F930F6D39A0692875D4D
7572	DeriaLock.exe	C:\Users\admin\Documents\transportationmiles.rtf.deria		binary
		MD5:5992AF2FF8BAD95DAD3FBA435D740B49	SHA256:3FF655E9D70DBB7EC8D59A2B7FEBA0D063F4C740C4413C45F50B97F641A9E0A0
7572	DeriaLock.exe	C:\Users\admin\Documents\Database1.accdb.deria		binary
		MD5:7963E7FCF2B789476CFFE2190C8B1DD6	SHA256:A6AA9BF095A0D0B5A91B7914566000ABC4B42D7C0B72417E1AAE0CEC7113BA03
7572	DeriaLock.exe	C:\Users\admin\Downloads\desktop.ini.deria		binary
		MD5:5E2A32EA1F7FE7346A3BE9229262FF7C	SHA256:14E414988E25F8B49F8ABB34ED5EA8DC833B4CE0224160D17BCAFD19857C6992
7572	DeriaLock.exe	C:\Users\admin\Pictures\titleschanges.jpg.deria		binary
		MD5:C4539F017D7773D02B5F94B602895F77	SHA256:83811F7C3E6D1AAB8DA9885695196D5241D75F2EE94874AFADFA1FEF6B34215D
7572	DeriaLock.exe	C:\Users\admin\Pictures\meansde.jpg.deria		binary
		MD5:64B275658EBA86FF486C02AEC4DC5F9D	SHA256:86F55976388296FC9BA1497AF1EB5D356499CE4AA67CDEC3ABC8AED82BB19EE1
7572	DeriaLock.exe	C:\Users\admin\Downloads\stopmedia.png.deria		binary
		MD5:8ECAD163DA7A83839B4E200336D4C099	SHA256:2422C86A591231C3F2172CCF97A4EDBE3BAEA58D09569A0D3B8BB05AD7EB8F8E

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/unlock-everybody.txt	unknown	—	—	whitelisted
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/UNLOCKKEYS/LOGON.exe	unknown	—	—	whitelisted
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/unlock-everybody.txt	unknown	—	—	whitelisted
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/unlock-everybody.txt	unknown	—	—	whitelisted
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/unlock-everybody.txt	unknown	—	—	whitelisted
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/unlock-everybody.txt	unknown	—	—	whitelisted
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/unlock-everybody.txt	unknown	—	—	whitelisted
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/UNLOCKKEYS/2d325786c6fc3319f19f824adefaa230.txt	unknown	—	—	whitelisted
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/unlock-everybody.txt	unknown	—	—	whitelisted
7572	DeriaLock.exe	GET	404	162.55.0.137:80	http://arizonacode.bplaced.net/HF/SystemLocker/unlock-everybody.txt	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2104	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5496	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
7572	DeriaLock.exe	162.55.0.137:80	arizonacode.bplaced.net	Hetzner Online GmbH	DE	whitelisted
3216	svchost.exe	172.211.123.249:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
6544	svchost.exe	40.126.31.67:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2112	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2104	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 40.127.240.158	whitelisted
google.com	142.250.186.142	whitelisted
arizonacode.bplaced.net	162.55.0.137	whitelisted
client.wns.windows.com	172.211.123.249	whitelisted
login.live.com	40.126.31.67 40.126.31.1 20.190.159.131 20.190.159.130 20.190.159.0 40.126.31.73 20.190.159.128 20.190.159.71	whitelisted
slscr.update.microsoft.com	4.245.163.56	whitelisted
fe3cr.delivery.mp.microsoft.com	52.165.164.15 2a01:111:f100:9001::1761:914d	whitelisted
15.164.165.52.in-addr.arpa	—	unknown
d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa	—	unknown

Threats

No threats detected

Add for printing

No debug info

General Info

DeriaLock.exe

0A7B70EFBA0AA93D4BC0857B87AC2FCB

01A6C963B2F5F36FF21A1043587DCF921AE5F5CD

4F5BFF64160044D9A769AB277FF85BA954E2A2E182C6DA4D0672790CF1D48309

6144:lqHKx3YCgy8HmmjJpnVhvLqCO3bLinIz1wASxQ:lqHoyHNj/nVhvLcyIIQ

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

RANSOMWARE has been detected

SUSPICIOUS

Process requests binary or script from the Internet

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Creates files or folders in the user directory

Disables trace logs

Checks proxy server information

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings