8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.bat
Size 1KB
Sample260625-wv7bead141
SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
TLSH
T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	4772	cmd.exe
11	4772	cmd.exe
12	4772	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
4772	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4772	cmd.exe
4772	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 4772	964	cmd.exe	90
PID 4772 wrote to memory of 4940	4772	cmd.exe	93
PID 4940 wrote to memory of 4772	4940	clink_x64.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clink.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\system32\cmd.exe
  cmd.exe /s /k ""C:\Users\Admin\AppData\Local\Temp\clink.bat" inject "
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\clink_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\clink_x64.exe" inject
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.27.83514e_ddde27f6\clink_dll_x64.dll
Size 2.8MB
SHA256 e732b96c89e16e5a291ce26215928fa797c6ebb187679ff99eaaa9efd636bf5e
MD5 370776bc2b1d448a8bf63b755bb6dff2
SHA1 6ad0eb8c5589c94fc5b4f7605ffafa30ef80a39e
SHA512 71f41afbd793abaa81eb58f0506c72664850b2ba20566f33a14116bc03d63c2aa7662c80f04bb9f225f0b40649a881d0281f0a0214168dc460f90c3497506978
SSDEEP 49152:jtalPUCvHVOfFkBV8nmjGekiXgCHWg26G+FyH88SQjN:Ral88HWqFtxwCDG+FY
TLSH
T1E5D58D47F2B906AAC06B8034C9571657E7B1B5994724E7EB13D0827A2F23BF516BF380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.27.83514e_ddde27f6\clink_dll_x64.dll.origin
Size 51B
SHA256 30f357be16b438b012273b6030fdd0aa5dc2002b933b548b51bb3963028084f0
MD5 a74f26fa457f716c83bc194232730b00
SHA1 51df2c0c3eab65330e92110c92bfbdc840e00e14
SHA512 b3f9770f247cdaf3c4bbf89234821e76d10d357ee1fc1b2683830b928255663a46b3cf61275c1334e9e77d8441dfe095bbf272c42c7c5bb2e8c797a2c519089f
TLSH
T13290021052C796190405B4774565564CC571091A2E8637268EA1844862524CAE691201
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 3748b9e6553558e5a9425ad7fef3c7adb9331cf3c3382dd355e8daa8d93ad9aa
MD5 8545a3de4446841252fe1d84947dce71
SHA1 e4fdbe9c4fa9af9508463aad63fa556a2859e6e9
SHA512 bce1beb0a27e396ef698ce155185ceb1f105735dd5a4cb3c2f644c5aadbdeed9eaaa8a381941ff1397b325448db6aec60693e28e828944cf08f1468f4b6a3946
TLSH
T17131F2006CC5D330A7A6C25154FBB30DE74BF10B9EC08023BC14D449B74BAAAA3EF196
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 4e577b1b28a6d6b00507c229f0f6ff6b0ff30bed70824fdf06014457dde0c821
MD5 66389aa3089ae9a1e47b512d13e52c18
SHA1 633e02068c2c287a402a1e7aeb739e1908b0a875
SHA512 b58d1b1bb2f4c2fff501f21f3e7c94a0a170ef1f41059ec9bfc61e1ac46ed4c65b68563674ddc31580701d382269e662771ae7e38ca55964d54ae828b02828f2
TLSH
T19D51CE006CC5E330A767C16098BB730CE74BF2179ED0C023B81DD55AB74B9AE92AF596
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4772-1-0x0000019634C00000-0x0000019634C01000-memory.dmp

Download

memory/4772-5-0x0000019634C10000-0x0000019634C11000-memory.dmp

Download

memory/4772-4-0x0000019634C00000-0x0000019634C01000-memory.dmp

Download

memory/4772-21-0x0000019634C10000-0x0000019634C11000-memory.dmp

Download