8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.bat
Size 1KB
Sample260417-asm9vsf14v
SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
TLSH
T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4220	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
4220	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4220	cmd.exe
4220	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4220	5116	cmd.exe	84
PID 4220 wrote to memory of 4400	4220	cmd.exe	86
PID 4400 wrote to memory of 4220	4400	clink_x64.exe	84

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clink.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\system32\cmd.exe
  cmd.exe /s /k ""C:\Users\Admin\AppData\Local\Temp\clink.bat" inject "
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Users\Admin\AppData\Local\Temp\clink_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\clink_x64.exe" inject
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.19.77e487_ddde27f6\clink_dll_x64.dll
Size 2.8MB
SHA256 d49728a2fa3712bbbf15b7143b318a1c76b04d906dbb9c72987aa27fb0ec6094
MD5 cd634fcc9ba191ae8bf68d0deaf79f40
SHA1 3d8950d359a2424130af36e948fb5d31aa45c8a8
SHA512 8edd265732b3ebb88f2ed848e6a53bfa3ee00cd599cacbf6ace43102251543d937f354b8d6bf8d443839d4fe89820484780f470ad69aebd1b1febdaaf0d59342
SSDEEP 49152:TZwpacFea0sIUKXzd4bvfw7EObQLnQyArMUYdD:TyFgsIN8vo7EBQ/rMf
TLSH
T1E6D59E56F2B902ABD06B8034C9571A53E7B1B5994724E7DB13D482792F23BF12A7F380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.19.77e487_ddde27f6\clink_dll_x64.dll.origin
Size 51B
SHA256 30f357be16b438b012273b6030fdd0aa5dc2002b933b548b51bb3963028084f0
MD5 a74f26fa457f716c83bc194232730b00
SHA1 51df2c0c3eab65330e92110c92bfbdc840e00e14
SHA512 b3f9770f247cdaf3c4bbf89234821e76d10d357ee1fc1b2683830b928255663a46b3cf61275c1334e9e77d8441dfe095bbf272c42c7c5bb2e8c797a2c519089f
TLSH
T13290021052C796190405B4774565564CC571091A2E8637268EA1844862524CAE691201
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 cf6b4c47e4190ce4d771cbf907128ea005493eec6131054a6c65566cdbc16cb3
MD5 9ac2c032c6505751d01d5ce005062b04
SHA1 d7f047517d2c78e07cdd0734a809751e092acb04
SHA512 4a02172263b166504e316799dd8dcb609ac63d041104be29e7c880543adbc6f6704353fe4d98ae8fb6db7ef1999275c1b75915b5dcdc4db64c5f22ae1c53a425
TLSH
T1C031D0449DC1C328A3AAC35554FE730FE767F90B5ED080277810E409239B55742CF906
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 abaff5d71ecd748efaeb6610bdee1fc3ce04d230413800ee58a3208569cefa33
MD5 99b04c0217b52151fca2bf04bd894449
SHA1 d26e2152f7074b411d8b44315e94416718bcda16
SHA512 38063255548c3e0ec524496f2c5a0f6dc3eb510b84ee51cac2c9f74bce60cb1e6148287e7efbc316ac62dd6cfe447cfe96974cc5004044774f029bf96d8aaf28
TLSH
T1A941E0409DC1C329A3ABC36554BE730FE727FA075E90D027B814E55A335F5AB428F816
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 76d15e446f87e963644799137aa466a69d3a41b00d8260863d64d78e491f7e5b
MD5 219ddcce59146759928d01811cb12c67
SHA1 86cdb55c65a349b6166380a3b853d84baa211317
SHA512 ebd0b994aef832df8bfa68bdcc64073f98ae9779d52b2f6f6213badbd8f3684518e81469f57083d98074912ca2eaa5682d7cfaafce9c580b24916ddd07395bab
TLSH
T11541F1849DC1D329A26BC36454BF730FE727FA075E80D023B814E15A735F59B428F806
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4220-3-0x000001CC7AD60000-0x000001CC7AD61000-memory.dmp

Download

memory/4220-8-0x000001CC7ADB0000-0x000001CC7ADB1000-memory.dmp

Download

memory/4220-24-0x000001CC7ADB0000-0x000001CC7ADB1000-memory.dmp

Download

memory/4220-7-0x000001CC7AD60000-0x000001CC7AD61000-memory.dmp

Download