40c5baa1404de9eff3daec3149a61bb0881d9dcfcad42d2a7ecbf98566b4f45e

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PlinkoScanner_Premium(Trial)/hashdecrypter/gmp-clearkey/2.1/sniclmainbin.exe
Size 35.2MB
Sample261013-3fhstsdf96
SHA256 40c5baa1404de9eff3daec3149a61bb0881d9dcfcad42d2a7ecbf98566b4f45e
MD5 568a55ee516f76589cce5ae1c302caea
SHA1 0da9a9af425a56b70ed15dd42eb88a4c18feab3e
SHA512 893ad427495c0fc21d762959101712cf196b1195fc37d5518f08e2a8c19b2640d346581b6a485b5289994b0c014a483826f2e371713e3086a8ad92f40508ba8c
SSDEEP 24576:WFJZrOe7tptV7rPVYJewcd1UMYQe9SY8mZnTn4Xliy6C79:WrNOYfjrGewcTUhSXm5C79
TLSH
T16E875D11BE479A6FC09EC470824A46622A31B8CA0B39BEFF51C453753E66AF51F7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4152	Sniclmain.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	sniclmainbin.exe
File opened (read-only)	\??\F:	Sniclmain.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sniclmainbin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sniclmainbin.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Sniclmain.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Sniclmain.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
620	sniclmainbin.exe
4152	Sniclmain.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
6120	sniclmainbin.exe
6120	sniclmainbin.exe
6120	sniclmainbin.exe
4152	Sniclmain.exe
4152	Sniclmain.exe
4152	Sniclmain.exe
4152	Sniclmain.exe
4152	Sniclmain.exe
4152	Sniclmain.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 620	6120	sniclmainbin.exe	90

C:\Users\Admin\AppData\Local\Temp\PlinkoScanner_Premium(Trial)\hashdecrypter\gmp-clearkey\2.1\sniclmainbin.exe
"C:\Users\Admin\AppData\Local\Temp\PlinkoScanner_Premium(Trial)\hashdecrypter\gmp-clearkey\2.1\sniclmainbin.exe"
1⤵
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Users\Admin\AppData\Local\Temp\PlinkoScanner_Premium(Trial)\hashdecrypter\gmp-clearkey\2.1\sniclmainbin.exe
  "C:\Users\Admin\AppData\Local\Temp\PlinkoScanner_Premium(Trial)\hashdecrypter\gmp-clearkey\2.1\sniclmainbin.exe" portable
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  PID:620

C:\Users\Admin\AppData\Roaming\sniclmain\Sniclmain.exe
C:\Users\Admin\AppData\Roaming\sniclmain\Sniclmain.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sniclmain.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Sniclmain.lnk
Size 623B
SHA256 bef2d57cab6a26f78c83ab8b7c8c253672858c1d5fd2b57f644cd3c46bbcdf5c
MD5 89f3b8a17963523199e180ea90e218fa
SHA1 ada2b0e9478da3c7486450d9cf7a29ef2f8bac60
SHA512 8be9b9f30ff4141c3ddf6a320fecd38ade98d84fa2d8a07410780c028c03fe7449cbbc0c714ae41efa6575681f777db9dfe9caf2cd40baeaf5f004b5ef2d3ac2
TLSH
T126F0A75D8C9A6E10F6F39A30A2ABD221C9146C715F09331A419440247872E915F3ABB7
MD5 SHA1 SHA512 TLSH

Submit Download

Sniclmain.exe

Path C:\Users\Admin\AppData\Roaming\sniclmain\Sniclmain.exe
Size 35.2MB
SHA256 40c5baa1404de9eff3daec3149a61bb0881d9dcfcad42d2a7ecbf98566b4f45e
MD5 568a55ee516f76589cce5ae1c302caea
SHA1 0da9a9af425a56b70ed15dd42eb88a4c18feab3e
SHA512 893ad427495c0fc21d762959101712cf196b1195fc37d5518f08e2a8c19b2640d346581b6a485b5289994b0c014a483826f2e371713e3086a8ad92f40508ba8c
SSDEEP 24576:WFJZrOe7tptV7rPVYJewcd1UMYQe9SY8mZnTn4Xliy6C79:WrNOYfjrGewcTUhSXm5C79
TLSH
T16E875D11BE479A6FC09EC470824A46622A31B8CA0B39BEFF51C453753E66AF51F7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download