8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.bat
Size 1KB
Sample260720-wp5kmaaw7j
SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
TLSH
T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	3312	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
3312	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1556	cmd.exe
3312	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3312	cmd.exe
3312	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3312	1556	cmd.exe	90
PID 3312 wrote to memory of 5964	3312	cmd.exe	93
PID 5964 wrote to memory of 3312	5964	clink_x64.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clink.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\system32\cmd.exe
  cmd.exe /s /k ""C:\Users\Admin\AppData\Local\Temp\clink.bat" inject "
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Executes a command shell one-liner
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Users\Admin\AppData\Local\Temp\clink_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\clink_x64.exe" inject
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.30.85f10f_ddde27f6\clink_dll_x64.dll
Size 2.8MB
SHA256 e693ec47cbb8141ed062e123533bfb209221ecae0112a38483861c3823e8a0ed
MD5 6db096e0d5baad00464f47f64bf69f33
SHA1 498290d99a558f9c20100c820985ddbcfac130b3
SHA512 4d390a680e1e67b80e006e6b995eced8572497cfbd76dd0ae52ec6319165e384a3e00df6c0b5a1964723cff820733377a3c0de9afcf04bfc648250e914a2b2bd
SSDEEP 49152:vE+Hra+idUWqfRL4mBMCIyumx6znz4ydG+F1GiLv:7H++uU780hxVwG+Tv
TLSH
T1FED59E56F2B906ABC06B8034C9571653E7B1B4994724E7DB13D0927A2F23BF52A7F380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.30.85f10f_ddde27f6\clink_dll_x64.dll.origin
Size 51B
SHA256 30f357be16b438b012273b6030fdd0aa5dc2002b933b548b51bb3963028084f0
MD5 a74f26fa457f716c83bc194232730b00
SHA1 51df2c0c3eab65330e92110c92bfbdc840e00e14
SHA512 b3f9770f247cdaf3c4bbf89234821e76d10d357ee1fc1b2683830b928255663a46b3cf61275c1334e9e77d8441dfe095bbf272c42c7c5bb2e8c797a2c519089f
TLSH
T13290021052C796190405B4774565564CC571091A2E8637268EA1844862524CAE691201
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 74563e143208a9d29f83aaccad6f49f45e38f1ba2dc77e3e789fc3c657634878
MD5 52b9d21d509c8daf1b163d7369fbdea5
SHA1 a42f779365042d9daba0495ec0f40644eefa6039
SHA512 2e13c73c46ba4e4ebc739e93c57845aa136f7b81434e68e67ef81deff782f7c58bf3cd16a17f365f68778cf848dfdc4991e61ea1cc8095d41a177f3b84fa2ad5
TLSH
T1BD31D0009C82D767E3A7C27118F9670CEB5DF6639D80C067B824C61D1B9F4A6C2DF156
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 e5a739c662ed9c619ec5a5c6ee1d87ddb2f9921428a1bce94ddd94db574909db
MD5 fb669ccf8b1c7075f074a3d0ad6387b9
SHA1 ccc41b88d7d72416c2aacfb728d3ccee6e9341b4
SHA512 d3e7c518ea1edd925bb64b878bf3a5ea22ea30219699e409cbe774714e3dddd5ad98ab145a6b7d0711eb8b2f9cc469088dcd61bc9d6699a361ebd538d37bf219
TLSH
T11C417C409C82D663E3A7D2B118F6770CEA5DF2639D80C057B814C65E2B6F4EAC19F06A
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 3KB
SHA256 d87fee04963f5f0fadd2972071c37cc2badb369483e37fbde011dfd17defa9fe
MD5 445140b10b30ef4e983f4ba90259e206
SHA1 c4249ab5ca6a49e4ef08b9c8bd718a8cbb594fee
SHA512 4048b92349afb52e0b5b56ac7c64a31f9df5c6136860c00b65d0e2e48dc7f6ae61fd64470bfd6996be080fef63d730f026d446184ed167530186d4a68b50a1d2
TLSH
T11871F3005C82D66793A7D6719CB5270CE62DF2638D40C09BF40CC25D77AB0EAC2AF4AA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3312-1-0x000001DF53B50000-0x000001DF53B51000-memory.dmp

Download

memory/3312-5-0x000001DF53B60000-0x000001DF53B61000-memory.dmp

Download

memory/3312-21-0x000001DF53B60000-0x000001DF53B61000-memory.dmp

Download

memory/3312-4-0x000001DF53B50000-0x000001DF53B51000-memory.dmp

Download

memory/3312-40-0x000001DF558D0000-0x000001DF55B11000-memory.dmp

Download