Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
02/07/2026, 00:10
General
- Target 2026-07-01_6731d0a8030b8a49c8ef2d7438809f1e_snatch.exe
- Size 2.2MB
- Sample260702-agf2eags3n
- SHA256 197d2cc92fec1f05e4cd8f5678698e6562b1161e859075657c7dfa9d5bd81ae7
Malware Config
Extracted
-
vidar
-
1.8
-
3bc41b1aa7524456de3f85c8d329d639
-
https://telegram.me/kkb31rm
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0
Signatures
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_6731d0a8030b8a49c8ef2d7438809f1e_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_6731d0a8030b8a49c8ef2d7438809f1e_snatch.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3676-0-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-1-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-2-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-3-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-4-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-5-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-6-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-7-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-8-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-9-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-10-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-11-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-12-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-13-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-14-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-15-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-17-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-16-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-18-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-19-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-20-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-21-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-22-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-23-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-24-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-25-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-26-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-27-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-29-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-28-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-30-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-31-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-32-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-33-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-34-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-35-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-36-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-37-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-38-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-39-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-40-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-41-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-42-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-43-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-44-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-45-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-46-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-47-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-48-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-49-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-50-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-51-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-52-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-53-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-54-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-55-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-56-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-57-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-58-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-59-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-60-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-61-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-62-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-63-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-64-0x0000000410000000-0x00000004101E9000-memory.dmp
memory/3676-65-0x0000000410000000-0x00000004101E9000-memory.dmp