8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.bat
Size 1KB
Sample260701-aptbpscz2w
SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
TLSH
T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	6064	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
6064	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6064	cmd.exe
6064	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 6064	1948	cmd.exe	87
PID 6064 wrote to memory of 2352	6064	cmd.exe	89
PID 2352 wrote to memory of 6064	2352	clink_x64.exe	87

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clink.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\cmd.exe
  cmd.exe /s /k ""C:\Users\Admin\AppData\Local\Temp\clink.bat" inject "
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Users\Admin\AppData\Local\Temp\clink_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\clink_x64.exe" inject
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.28.ae0f63_ddde27f6\clink_dll_x64.dll
Size 2.8MB
SHA256 b3801254e53dbaf0bad0570ea19260142005f0518edfe77faf3892c7941f5089
MD5 1b4a9c33f9ebb88d7e881542744f0149
SHA1 894fe8cd1acc90e72a0619ce6b601d1044c39014
SHA512 0a41017a57cf1201caab6e9540c5613b0786495d27f79900a762763a8e493d69390808d7870cf64b06ef67c6e58e127016b62011d8214a78149d3fd735a5a4d0
SSDEEP 49152:y0pUHL+83NiKUSueQwvq+LTxaws2Br7LG+Fy9c91v:5pUr1NVtbxFdXXG+Fx
TLSH
T12DD59E56F2B906ABC06B8034C9571653E7B1B49A4724E7EB53D092792F23BF1267F380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.28.ae0f63_ddde27f6\clink_dll_x64.dll.origin
Size 51B
SHA256 30f357be16b438b012273b6030fdd0aa5dc2002b933b548b51bb3963028084f0
MD5 a74f26fa457f716c83bc194232730b00
SHA1 51df2c0c3eab65330e92110c92bfbdc840e00e14
SHA512 b3f9770f247cdaf3c4bbf89234821e76d10d357ee1fc1b2683830b928255663a46b3cf61275c1334e9e77d8441dfe095bbf272c42c7c5bb2e8c797a2c519089f
TLSH
T13290021052C796190405B4774565564CC571091A2E8637268EA1844862524CAE691201
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 c13990d92e6fdad042d87a18ebcc2c68bf94cb8fd600970124f149baecdd7299
MD5 e004d4b97e489b1b5bad8350ef14a6d7
SHA1 732598b5b4ac202d5719d66eeffb74d056a322b4
SHA512 ab19d3a3a25e4b0d8b955598c35c63212b16b209b16a79daa88b570db4f997954318b0a286e05576f0fea7c51368cf5efbeaaa25b5a94a112f80d4fd0dc4cf54
TLSH
T12A31CC40AC85D312B393E65750FAA30DDB69F5136FD0A023BC19CA0F834B5A542CE297
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 a7173e7910b63457fff90c137d851d9ba02b046a7810fa58963e807305daa1a7
MD5 b121a9ca93a50d3577d6298ab2ebde91
SHA1 73ec5b037073c91ee28f7183d5b089b63ff40482
SHA512 262511819117754f2dd7680a64dc19359252606f4e920a92c40e5acfa50db5b1b7a8edc550c36edda816c2c73f265c568461dc1c02cd673eee35d3bbf44251e9
TLSH
T102418140AC859312B363E1A764FAB30CDA69F6136ED0E023BC19D55F930F5E5928F257
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6064-3-0x000001A48CCA0000-0x000001A48CCA1000-memory.dmp

Download

memory/6064-8-0x000001A48E490000-0x000001A48E491000-memory.dmp

Download

memory/6064-24-0x000001A48E490000-0x000001A48E491000-memory.dmp

Download

memory/6064-7-0x000001A48CCA0000-0x000001A48CCA1000-memory.dmp

Download