8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.bat
Size 1KB
Sample260701-aptbpscz2w
SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
TLSH
T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3036	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
3036	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3036	cmd.exe
3036	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6944 wrote to memory of 3036	6944	cmd.exe	91
PID 3036 wrote to memory of 6332	3036	cmd.exe	93
PID 6332 wrote to memory of 3036	6332	clink_x64.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clink.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:6944
- C:\Windows\system32\cmd.exe
  cmd.exe /s /k ""C:\Users\Admin\AppData\Local\Temp\clink.bat" inject "
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Users\Admin\AppData\Local\Temp\clink_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\clink_x64.exe" inject
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.28.ae0f63_ddde27f6\clink_dll_x64.dll
Size 2.8MB
SHA256 b3801254e53dbaf0bad0570ea19260142005f0518edfe77faf3892c7941f5089
MD5 1b4a9c33f9ebb88d7e881542744f0149
SHA1 894fe8cd1acc90e72a0619ce6b601d1044c39014
SHA512 0a41017a57cf1201caab6e9540c5613b0786495d27f79900a762763a8e493d69390808d7870cf64b06ef67c6e58e127016b62011d8214a78149d3fd735a5a4d0
SSDEEP 49152:y0pUHL+83NiKUSueQwvq+LTxaws2Br7LG+Fy9c91v:5pUr1NVtbxFdXXG+Fx
TLSH
T12DD59E56F2B906ABC06B8034C9571653E7B1B49A4724E7EB53D092792F23BF1267F380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.28.ae0f63_ddde27f6\clink_dll_x64.dll.origin
Size 51B
SHA256 30f357be16b438b012273b6030fdd0aa5dc2002b933b548b51bb3963028084f0
MD5 a74f26fa457f716c83bc194232730b00
SHA1 51df2c0c3eab65330e92110c92bfbdc840e00e14
SHA512 b3f9770f247cdaf3c4bbf89234821e76d10d357ee1fc1b2683830b928255663a46b3cf61275c1334e9e77d8441dfe095bbf272c42c7c5bb2e8c797a2c519089f
TLSH
T13290021052C796190405B4774565564CC571091A2E8637268EA1844862524CAE691201
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 0ccb2bafa65958e5e67107a26457d5985af48d1df4c620d3373eac8a5a02c95b
MD5 8dc45a9e3c6bb938a5102643dc50ca50
SHA1 314621bdb1f4389f9b28e317822aca482cea1e73
SHA512 18e9769f00ca7cfbd5b2f2e6ee7c858bdf9f0eceb5e368b188d5c3cde9f517437137d6d546d8da688478341c0c40ff3e356bf8c4df6d52fb630bfa882b90dfe3
TLSH
T142216C00DC95D310A3AEC2A564FAB34DD76CF70B4A909037AD20D45A578E9B6429F54F
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 a75e6045540340fe60aa5a78b55e21b1c8326483d85fdcb6b90a782add1a2b14
MD5 505e7a409b018c5158f826b4562826f4
SHA1 b2148d97628c1c891983ac564d4181ad2edc40ca
SHA512 b609b00e49a8938b0d13aa222ac4c53a9e6be725a1c9efc0867f6c4e0f5e045262587349c62e47e6b8d8c97fa8cb8dea21190838c7e224a4a412e99823a20ae7
TLSH
T10431BB009C85D310B3AEC2A560FAB349D76CF20B4A909037BD24D45A578E9B6039F48F
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 06928a54a663425fe2a08bdae342f3a8f1474bb61a47a916f0069ff449cbb7a1
MD5 249875bcbbf7d7f91b7abff3ea7e0b61
SHA1 8a2e738723e3ac2f9387f3c8c8981616e1af1f71
SHA512 b0ec3af8e516200384bc60662fbcc09ffacd6576fb5388d3e45a07af12fa9be18f37b841a020b02eb9bcc35ff371d8008864a117ee16e58d0474e973a6f7ca38
TLSH
T111419B009C859620A36FC2A164FB7349D76CF30B4E909037BD14D56B6B5F5B6425F48F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3036-1-0x000001DF3D600000-0x000001DF3D601000-memory.dmp

Download

memory/3036-5-0x000001DF3EDF0000-0x000001DF3EDF1000-memory.dmp

Download

memory/3036-4-0x000001DF3D600000-0x000001DF3D601000-memory.dmp

Download

memory/3036-21-0x000001DF3EDF0000-0x000001DF3EDF1000-memory.dmp

Download