Analysis date (UTC): 10 April 2026, 10:44Analysis environment: Windows 10 Pro, build 19044, x64

https://discord.com/ra/98rFlTC8zPOXAVOi3dwdsGSeWHF4z9HTRBzDjTku4kY

MD5:50FC1920DFC2A2F80219895EF5DDB4EB

SHA1:CB364AB7631F6350937E7535D9330D60EEE5C9B4

SHA256:BBA10175DBC8FCB915BBECBD3EC83ED4E1EB403B18233D0082E91FA8AEB7F3BD

Analysis result

Threat level:Malicious activity

Tags:

discordphishingfilename-lurepayloadnodejsrustwebsocket

Full analysis:Analysis https://discord.com/ra/98rFlTC8zPOXAVOi3dwdsGSeWHF4z9HTRBzDjTku4kY Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Phishing lure filenames

Discord.exe (PID: 8476)

Executing a file with an untrusted certificate

DiscordSystemHelper.exe (PID: 7648)
DiscordSystemHelper.exe (PID: 2724)
DiscordSystemHelper.exe (PID: 8140)
DiscordSystemHelper.exe (PID: 7708)
DiscordSystemHelper.exe (PID: 2988)
DiscordSystemHelper.exe (PID: 7984)
DiscordSystemHelper.exe (PID: 9132)
DiscordSystemHelper.exe (PID: 8956)

SUSPICIOUS

Executable content was dropped or overwritten

DiscordSetup.exe (PID: 8468)
Update.exe (PID: 8488)
Discord.exe (PID: 8652)
DiscordSystemHelper.exe (PID: 2724)

Possible stealing of messenger data

Discord.exe (PID: 8772)

Application launched itself

Discord.exe (PID: 8772)
Discord.exe (PID: 8652)
DiscordSystemHelper.exe (PID: 7648)

Uses REG/REGEDIT.EXE to modify or delete registry entries

Discord.exe (PID: 8772)
Discord.exe (PID: 8652)

Searches for installed software

Update.exe (PID: 8488)

Reads the date of Windows installation

DiscordSystemHelper.exe (PID: 7648)

Executes as Windows Service

DiscordSystemHelper.exe (PID: 2988)
DiscordSystemHelper.exe (PID: 9132)

Starts itself from another location

DiscordSystemHelper.exe (PID: 2988)
DiscordSystemHelper.exe (PID: 9132)

Discord domain found in command line (probably downloading payload)

msedge.exe (PID: 7796)

INFO

Reads Environment values

identity_helper.exe (PID: 2340)
Discord.exe (PID: 8772)
Discord.exe (PID: 8652)
Discord.exe (PID: 8476)

Application launched itself

msedge.exe (PID: 7804)

Reads the computer name

identity_helper.exe (PID: 2340)
Update.exe (PID: 8488)
Discord.exe (PID: 8772)
Update.exe (PID: 8884)
Discord.exe (PID: 8984)
Discord.exe (PID: 9020)
Discord.exe (PID: 8652)
Discord.exe (PID: 8420)
Discord.exe (PID: 8376)
Discord.exe (PID: 8476)
Discord.exe (PID: 8468)
gpu_encoder_helper.exe (PID: 8696)
gpu_encoder_helper.exe (PID: 7452)
gpu_encoder_helper.exe (PID: 5876)
gpu_encoder_helper.exe (PID: 8048)
Discord.exe (PID: 7440)
DiscordSystemHelper.exe (PID: 7648)
DiscordSystemHelper.exe (PID: 2724)
DiscordSystemHelper.exe (PID: 8140)
DiscordSystemHelper.exe (PID: 7708)
DiscordSystemHelper.exe (PID: 2988)
DiscordSystemHelper.exe (PID: 7984)
DiscordSystemHelper.exe (PID: 9132)
Discord.exe (PID: 8800)
DiscordSystemHelper.exe (PID: 8956)

Checks supported languages

identity_helper.exe (PID: 2340)
DiscordSetup.exe (PID: 8468)
Update.exe (PID: 8488)
Discord.exe (PID: 8840)
Update.exe (PID: 8884)
Discord.exe (PID: 9020)
Discord.exe (PID: 8984)
Discord.exe (PID: 8772)
Discord.exe (PID: 8652)
Discord.exe (PID: 9212)
Discord.exe (PID: 8376)
Discord.exe (PID: 8420)
Discord.exe (PID: 9088)
Discord.exe (PID: 7868)
gpu_encoder_helper.exe (PID: 8696)
Discord.exe (PID: 8468)
Discord.exe (PID: 7440)
Discord.exe (PID: 8476)
gpu_encoder_helper.exe (PID: 5876)
gpu_encoder_helper.exe (PID: 7452)
gpu_encoder_helper.exe (PID: 8048)
DiscordSystemHelper.exe (PID: 7648)
DiscordSystemHelper.exe (PID: 2724)
DiscordSystemHelper.exe (PID: 8140)
DiscordSystemHelper.exe (PID: 7708)
DiscordSystemHelper.exe (PID: 2988)
DiscordSystemHelper.exe (PID: 7984)
DiscordSystemHelper.exe (PID: 9132)
DiscordSystemHelper.exe (PID: 8956)
Discord.exe (PID: 8800)

Create files in a temporary directory

DiscordSetup.exe (PID: 8468)
Update.exe (PID: 8488)
Discord.exe (PID: 8652)

Creates files or folders in the user directory

DiscordSetup.exe (PID: 8468)
Update.exe (PID: 8488)
Discord.exe (PID: 8840)
Discord.exe (PID: 8772)
Discord.exe (PID: 9020)
Update.exe (PID: 8884)
Discord.exe (PID: 9212)
Discord.exe (PID: 8652)
Discord.exe (PID: 8476)
Discord.exe (PID: 8420)
DiscordSystemHelper.exe (PID: 7648)
Discord.exe (PID: 8800)

Executable content was dropped or overwritten

msedge.exe (PID: 7804)

Reads the machine GUID from the registry

Update.exe (PID: 8488)
Update.exe (PID: 8884)
Discord.exe (PID: 8772)
Discord.exe (PID: 8652)
DiscordSystemHelper.exe (PID: 2988)
DiscordSystemHelper.exe (PID: 7984)
DiscordSystemHelper.exe (PID: 8956)
Discord.exe (PID: 8476)
DiscordSystemHelper.exe (PID: 9132)
Discord.exe (PID: 8800)

The sample compiled with english language support

Update.exe (PID: 8488)

Process checks computer location settings

Discord.exe (PID: 8772)
Update.exe (PID: 8488)
Discord.exe (PID: 8652)
Discord.exe (PID: 9088)
Discord.exe (PID: 7868)
Discord.exe (PID: 8476)
DiscordSystemHelper.exe (PID: 7648)

Reads product name

Discord.exe (PID: 8772)
Discord.exe (PID: 8652)
Discord.exe (PID: 8476)

Launching a file from a Registry key

reg.exe (PID: 8388)

Creates a software uninstall entry

Update.exe (PID: 8488)

Reads security settings of Internet Explorer

Update.exe (PID: 8488)
DiscordSystemHelper.exe (PID: 7648)
DiscordSystemHelper.exe (PID: 7984)
DiscordSystemHelper.exe (PID: 8956)
Discord.exe (PID: 8476)

Reads CPU info

Discord.exe (PID: 8476)

Node.js compiler has been detected

Discord.exe (PID: 8376)
Discord.exe (PID: 8652)
Discord.exe (PID: 9212)
Discord.exe (PID: 8420)

Application based on Rust

Discord.exe (PID: 8652)

There is functionality for taking screenshot (YARA)

Discord.exe (PID: 8376)

Threats

PID	Process	Class	Message
4324	msedge.exe	Misc activity	ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
4324	msedge.exe	Misc activity	ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
4324	msedge.exe	Misc activity	ET INFO Observed Discord Domain (discord .com in TLS SNI)
4324	msedge.exe	Misc activity	ET INFO Observed Discord Domain in DNS Lookup (discord .com)
4324	msedge.exe	Misc activity	ET INFO Observed Discord Domain in DNS Lookup (discord .com)
4324	msedge.exe	Misc activity	ET INFO Observed Discord Domain (discord .com in TLS SNI)
4324	msedge.exe	Misc activity	ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
4324	msedge.exe	Misc activity	ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
4324	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
4324	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)

Rows per page