Overview

overview

7

Static

static

3

Soda.v1.4.exe

windows10-2004-x64

7

Soda.v1.4.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 10:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Soda.v1.4.exe
  • Size 8.6MB
  • Sample260808-l6vrmsytc1
  • SHA256 e06623cc4bc2227bd3aeeced3758776051feee79102ad9f8cf79f1575f6d2e7e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 27 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Soda.v1.4.exe
    "C:\Users\Admin\AppData\Local\Temp\Soda.v1.4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5244
    • C:\Users\Admin\AppData\Local\Temp\Soda.v1.4.exe
      "C:\Users\Admin\AppData\Local\Temp\Soda.v1.4.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:2584
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic useraccount where name='%username%' get sid"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3376
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic useraccount where name='Admin' get sid
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3424

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\MSVCP140.dll
        • Size 561KB
        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\VCRUNTIME140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_asyncio.pyd
        • Size 62KB
        • SHA256 97ed94f8d35445573177ba75e17dcf4c667e3c236c0b4d436fa97f8c862cc0bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_bz2.pyd
        • Size 81KB
        • SHA256 190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_ctypes.pyd
        • Size 120KB
        • SHA256 7adcea3a5568752a6050610cfbe791a4f8186aaaa002f916b88560a1ddab580f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_decimal.pyd
        • Size 242KB
        • SHA256 2bab2833c24eb4e07fe082d291013eed000a5cfc22df49311c729e7a57fe632e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_hashlib.pyd
        • Size 60KB
        • SHA256 23063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_lzma.pyd
        • Size 154KB
        • SHA256 5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_multiprocessing.pyd
        • Size 32KB
        • SHA256 b28e94b921d5d539cbd5f97ff4926e4f186791af1b364de7be7fcce3970172f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_overlapped.pyd
        • Size 47KB
        • SHA256 370b4ad06881c3cb781be0f78476eaeb5e440c60498f5791c3d413860fdc9b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_queue.pyd
        • Size 29KB
        • SHA256 24c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_socket.pyd
        • Size 75KB
        • SHA256 71f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\_ssl.pyd
        • Size 155KB
        • SHA256 4e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\base_library.zip
        • Size 859KB
        • SHA256 927b335f7088b8a9f8509f99e59e5a86435a4a691a85a889a5bc6833a3a3381e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _dearpygui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\dearpygui\_dearpygui.pyd
        • Size 3.7MB
        • SHA256 6247c5e0e4fc8509269cac74f56ba0842c8756feee0031052ca2c0d3fc616c24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\psutil\_psutil_windows.pyd
        • Size 76KB
        • SHA256 67c17558b635d6027ddbb781ea4e79fc0618bbec7485bd6d84b0ebcd9ef6a478
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\pyexpat.pyd
        • Size 193KB
        • SHA256 30eb08571a88165b84bc0783c3ffbf19e9d99c5634ab274c73a8ddca163cafda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\python3.dll
        • Size 63KB
        • SHA256 abb50921ef463263acd7e9be19862089045074ea332421d82e765c5f2163e78a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\python310.dll
        • Size 4.3MB
        • SHA256 c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\pywin32_system32\pywintypes310.dll
        • Size 131KB
        • SHA256 c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\select.pyd
        • Size 28KB
        • SHA256 8b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\unicodedata.pyd
        • Size 1.1MB
        • SHA256 a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\win32\win32api.pyd
        • Size 130KB
        • SHA256 ac483d60a565cc9cbf91a6f37ea516b2162a45d255888d50fbbb7e5ff12086ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32gui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\win32\win32gui.pyd
        • Size 212KB
        • SHA256 2d283db8f452ccf3115c6fa5a53c3e6db7ca1f3b55288a862820266a1233137a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32process.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\win32\win32process.pyd
        • Size 52KB
        • SHA256 072621e1dc9904fa01aedc09f8e4d7801897471b172c7f764d10a5ca97b84319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winsound.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI52442\winsound.pyd
        • Size 28KB
        • SHA256 78e466bebe3b2718234d0e021931d8916fcbcf4666c8e65c4fee62c234c12435
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1948-92-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-95-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-90-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-91-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-88-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-93-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-94-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-89-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-96-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-97-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-98-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-99-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-100-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download

        memory/1948-101-0x000002222BD80000-0x000002222C1D9000-memory.dmp
        Download