8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.bat
Size 1KB
Sample260715-wpzdlsav8k
SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
TLSH
T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3724	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
3724	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3724	cmd.exe
3724	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3724	3168	cmd.exe	89
PID 3724 wrote to memory of 4572	3724	cmd.exe	91
PID 4572 wrote to memory of 3724	4572	clink_x64.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clink.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\system32\cmd.exe
  cmd.exe /s /k ""C:\Users\Admin\AppData\Local\Temp\clink.bat" inject "
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Users\Admin\AppData\Local\Temp\clink_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\clink_x64.exe" inject
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.29.fc1e8d_ddde27f6\clink_dll_x64.dll
Size 2.8MB
SHA256 4f12765514492c3a204edaa5c34637d3b7d187af4442dd3ebc377d37332e8983
MD5 a53eeb72a2648e8f4b631b94db143892
SHA1 3906f00b43618bbb5013a6d9ea71723851b8fa79
SHA512 378038099a2fb96d288c8057711e7f259ffae164b0d9459bdde4fc2bc37a9965763bf53f5f5f73c6742839c6ed959f301257ef67a9cfaba17cf8110717a9f81e
SSDEEP 49152:xpL537ebx70I0YfGU7o6ut7+oTydG+mo3X:fL56bx1FPuvwG+H
TLSH
T1D2D59E56F2B906ABC06B8034C9571653E7B1B4994725E7EB13D0827A2F23BF516BF380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.29.fc1e8d_ddde27f6\clink_dll_x64.dll.origin
Size 51B
SHA256 30f357be16b438b012273b6030fdd0aa5dc2002b933b548b51bb3963028084f0
MD5 a74f26fa457f716c83bc194232730b00
SHA1 51df2c0c3eab65330e92110c92bfbdc840e00e14
SHA512 b3f9770f247cdaf3c4bbf89234821e76d10d357ee1fc1b2683830b928255663a46b3cf61275c1334e9e77d8441dfe095bbf272c42c7c5bb2e8c797a2c519089f
TLSH
T13290021052C796190405B4774565564CC571091A2E8637268EA1844862524CAE691201
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 de7efe5b83bae51d4a0383cf10714582160a4c3ec4a11b59e57cc95ff6e8d070
MD5 c69e112146baed05f7df10c62a9e524a
SHA1 601f75e217af0ae9982f34cf8397e86ea3d5955f
SHA512 3e38c87d8cec9b4e56a37dae6f4cc0888df026d34457e17bb37781643da174904dba007f4c5e8a69351fb5ece40de391e8b8a50d38253506a02847c63803a20e
TLSH
T18C31BC809D85E268E7AAC16174FBB30EE75EF2078B818127A814D41D53CA1AE439F097
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 7ce83bf1182b67e2b180538fae403cf21155e08327ec3d2314dd63afca1d838e
MD5 743b349ec74d7f00cea5b7ea2bc47864
SHA1 5877b319f045e28d959befa0227ddac00d74788e
SHA512 09efc8655834a6aa7b16a71a6a3b238c7633cc78efdbfa578747c7846d6d123805adafca144a0720204eec4c436f9b6db8283d8b7c94a3d24a323f703b774597
TLSH
T153418C809D81A265E6ABD06174FBB30DE74EF2074F819127B814D16E678F0AE439F497
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3724-1-0x00000171C5F10000-0x00000171C5F11000-memory.dmp

Download

memory/3724-5-0x00000171C5F20000-0x00000171C5F21000-memory.dmp

Download

memory/3724-4-0x00000171C5F10000-0x00000171C5F11000-memory.dmp

Download

memory/3724-21-0x00000171C5F20000-0x00000171C5F21000-memory.dmp

Download