Analysis date (UTC): 26 September 2025, 23:14Analysis environment: Windows 10 Pro, build 19044, x64

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe

MD5:2271813E586D6D64B4F033765E20E657

SHA1:E44984F2F9FCFEAA88DBF55A614C95A5281D4C07

SHA256:DE4AD0B01E1913781687CDB841AF51668FFCAED82CBA24981D88648A715515FB

Analysis result

Threat level:Malicious activity

Tags:

discordevasionims-apigenericgolangip-check

Full analysis:Analysis de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (MD5: 2271813E586D6D64B4F033765E20E657) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Run PowerShell with an invisible window

powershell.exe (PID: 4864)

Changes powershell execution policy (Bypass)

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 1336)

Bypass execution policy to execute commands

powershell.exe (PID: 4864)

SUSPICIOUS

Application launched itself

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 6404)

Reads security settings of Internet Explorer

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 6404)

Reads the date of Windows installation

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 6404)

Executable content was dropped or overwritten

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 1336)

The process bypasses the loading of PowerShell profile settings

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 1336)

Starts POWERSHELL.EXE for commands execution

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 1336)

The process hide an interactive prompt from the user

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 1336)

Hides errors and continues executing the command without stopping

powershell.exe (PID: 4864)

Executes as Windows Service

socks5svc.exe (PID: 6312)

Checks for external IP

socks5svc.exe (PID: 6312)

Possible usage of Discord/Telegram API has been detected (YARA)

socks5svc.exe (PID: 6312)

There is functionality for capture public ip (YARA)

socks5svc.exe (PID: 6312)

INFO

Checks supported languages

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 6404)
de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 1336)
socks5svc.exe (PID: 6312)

Reads the computer name

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 6404)
de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 1336)
socks5svc.exe (PID: 6312)

Process checks computer location settings

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 6404)

Creates files in the program directory

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 1336)

Drops encrypted JS script (Microsoft Script Encoder)

de4ad0b01e1913781687cdb841af51668ffcaed82cba24981d88648a715515fb.exe (PID: 1336)

Reads the software policy settings

powershell.exe (PID: 4864)
socks5svc.exe (PID: 6312)
slui.exe (PID: 2728)

Reads security settings of Internet Explorer

powershell.exe (PID: 4864)

Create files in a temporary directory

powershell.exe (PID: 4864)

Application based on Golang

socks5svc.exe (PID: 6312)

Checks if a key exists in the options dictionary (POWERSHELL)

powershell.exe (PID: 4864)

Reads the machine GUID from the registry

socks5svc.exe (PID: 6312)

Detects GO elliptic curve encryption (YARA)

socks5svc.exe (PID: 6312)

Checks proxy server information

slui.exe (PID: 2728)

Threats

PID	Process	Class	Message
2200	svchost.exe	Misc activity	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2200	svchost.exe	Misc activity	ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
2200	svchost.exe	Misc activity	ET INFO Observed Discord Domain in DNS Lookup (discord .com)
—	—	Misc activity	ET USER_AGENTS Go HTTP Client User-Agent
—	—	Misc activity	ET INFO Go-http-client User-Agent Observed Outbound
6312	socks5svc.exe	Misc activity	ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
6312	socks5svc.exe	Misc activity	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
6312	socks5svc.exe	Misc activity	ET INFO Observed Discord Domain (discord .com in TLS SNI)
—	—	Device Retrieving External IP Address Detected	ET INFO External IP Lookup api.ipify.org
—	—	Misc activity	ET USER_AGENTS Go HTTP Client User-Agent

Rows per page