2e0f36ccc7edb1e8de3e37cae081a5e845ba9e248c3dd29395d52eb54566bf17

Analysis

max time kernel
149s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NGRP Launcher.exe
Size 212.7MB
Sample260802-2snzyatapd
SHA256 2e0f36ccc7edb1e8de3e37cae081a5e845ba9e248c3dd29395d52eb54566bf17
MD5 934d897da933b98581f130187a7883f5
SHA1 460400396d8f45cff65734895ce57e77c5554272
SHA512 fe95fe9f0d03ac98eb4d1f62e714364d53812bdad80abee2f1603007cf5f783446ce19f255040637a7e999673257bc4c816bfcb83d60341dbacc7fa4753df314
SSDEEP 1572864:OlwuqOCbUfxB8xWYVZHG7PzN4AiDHJUErDrKIlusdn2r4fXpB0IliopR5fl3JBQ4:OlwuqlZr5kNLlAO
TLSH
T1FAB88B03E29A41D9C01DD175975A9233FEB1B8454B24B3DF2BA447522F76EE82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4520	NGRP Launcher.exe
4520	NGRP Launcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe
Token: SeShutdownPrivilege	4988	NGRP Launcher.exe
Token: SeCreatePagefilePrivilege	4988	NGRP Launcher.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3444	4988	NGRP Launcher.exe	80
PID 4988 wrote to memory of 3444	4988	NGRP Launcher.exe	80
PID 4988 wrote to memory of 4204	4988	NGRP Launcher.exe	81
PID 4988 wrote to memory of 4064	4988	NGRP Launcher.exe	82
PID 4988 wrote to memory of 4064	4988	NGRP Launcher.exe	82
PID 4988 wrote to memory of 564	4988	NGRP Launcher.exe	83
PID 4988 wrote to memory of 564	4988	NGRP Launcher.exe	83
PID 4988 wrote to memory of 4520	4988	NGRP Launcher.exe	84

C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ngrp-launcher" --gpu-preferences=SAAAAAAAAADgABQEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1728,i,6387130703548325255,9087692493528702983,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1732,i,2781807691285469820,53697479198663744,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  PID:3444
- C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ngrp-launcher" --field-trial-handle=1728,i,6387130703548325255,9087692493528702983,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1732,i,2781807691285469820,53697479198663744,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  PID:4204
- C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ngrp-launcher" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1728,i,6387130703548325255,9087692493528702983,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1732,i,2781807691285469820,53697479198663744,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2380 /prefetch:1
  2⤵
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\ngrp-launcher" --field-trial-handle=1728,i,6387130703548325255,9087692493528702983,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1732,i,2781807691285469820,53697479198663744,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3324 /prefetch:12
  2⤵
  PID:564
- C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\NGRP Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\ngrp-launcher" --gpu-preferences=SAAAAAAAAADoABQEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1728,i,6387130703548325255,9087692493528702983,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1732,i,2781807691285469820,53697479198663744,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=1236 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\ngrp-launcher\Network\Network Persistent State
Size 1KB
SHA256 ea23131e868e7e280fcecc501c8a521fba32a99db1f16335204e78ff2d9ef9ec
MD5 f8b256144b1f00969903801241ac894b
SHA1 97febf31980e7d3083dcc801c7ba11997bdc0e34
SHA512 e38a407896bd2894af804f77397e5d3350834e0ca65d5cb47764016012b2cb56eade345b5f31abcbf3c948d37b919971693b286bef257b7d9e72a6f5a1705237
TLSH
T1D621A8A6C7EC467D885223F82B353E23C1AE092C42283C07C9E8EF8F53F2431920124E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe596874.TMP

Path C:\Users\Admin\AppData\Roaming\ngrp-launcher\Network\Network Persistent State~RFe596874.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\ngrp-launcher\Preferences
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe587f8b.TMP

Path C:\Users\Admin\AppData\Roaming\ngrp-launcher\Preferences~RFe587f8b.TMP
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3444-68-0x000001DB686C0000-0x000001DB68E69000-memory.dmp

Download

memory/3444-78-0x000001DB686C0000-0x000001DB68E69000-memory.dmp

Download

memory/3444-111-0x000001DB686C0000-0x000001DB68E69000-memory.dmp

Download

memory/4064-19-0x00007FFE17B20000-0x00007FFE17B21000-memory.dmp

Download

memory/4064-18-0x00007FFE17100000-0x00007FFE17101000-memory.dmp

Download

memory/4520-98-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download

memory/4520-97-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download

memory/4520-109-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download

memory/4520-108-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download

memory/4520-107-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download

memory/4520-106-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download

memory/4520-105-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download

memory/4520-104-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download

memory/4520-103-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download

memory/4520-99-0x0000012CEF730000-0x0000012CEF731000-memory.dmp

Download