8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.bat
Size 1KB
Sample260722-argqpas1gt
SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
TLSH
T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	2796	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2796	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6016	cmd.exe
2796	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	cmd.exe
2796	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 2796	6016	cmd.exe	90
PID 2796 wrote to memory of 1060	2796	cmd.exe	93
PID 1060 wrote to memory of 2796	1060	clink_x64.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clink.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\system32\cmd.exe
  cmd.exe /s /k ""C:\Users\Admin\AppData\Local\Temp\clink.bat" inject "
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Executes a command shell one-liner
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Users\Admin\AppData\Local\Temp\clink_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\clink_x64.exe" inject
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.30.85f10f_ddde27f6\clink_dll_x64.dll
Size 2.8MB
SHA256 e693ec47cbb8141ed062e123533bfb209221ecae0112a38483861c3823e8a0ed
MD5 6db096e0d5baad00464f47f64bf69f33
SHA1 498290d99a558f9c20100c820985ddbcfac130b3
SHA512 4d390a680e1e67b80e006e6b995eced8572497cfbd76dd0ae52ec6319165e384a3e00df6c0b5a1964723cff820733377a3c0de9afcf04bfc648250e914a2b2bd
SSDEEP 49152:vE+Hra+idUWqfRL4mBMCIyumx6znz4ydG+F1GiLv:7H++uU780hxVwG+Tv
TLSH
T1FED59E56F2B906ABC06B8034C9571653E7B1B4994724E7DB13D0927A2F23BF52A7F380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.30.85f10f_ddde27f6\clink_dll_x64.dll.origin
Size 51B
SHA256 30f357be16b438b012273b6030fdd0aa5dc2002b933b548b51bb3963028084f0
MD5 a74f26fa457f716c83bc194232730b00
SHA1 51df2c0c3eab65330e92110c92bfbdc840e00e14
SHA512 b3f9770f247cdaf3c4bbf89234821e76d10d357ee1fc1b2683830b928255663a46b3cf61275c1334e9e77d8441dfe095bbf272c42c7c5bb2e8c797a2c519089f
TLSH
T13290021052C796190405B4774565564CC571091A2E8637268EA1844862524CAE691201
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 7c12b0ce5ad2a652a45e480b135e5d7925d80d40801376eb2aa4a30401aa38cc
MD5 1607c27c7bfd017906baecb2f28805d1
SHA1 5519708a008ca65e5a6902a92bf45aa3a3b0e90d
SHA512 ddd57beec47a7a2ef2a7b1cd72053ef40d8dd49aabf506c405a70c7866f72614b25fe30a9cfd08c1dbc66f3cc289e1897d09689131d786623f847ea49c1a6233
TLSH
T1C42190109CC5D320A3AEE5A515FB730DDB5DF3079981D02FEC20C44E128D5A6928F55A
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 84591da7833ed1a9846f29a78ecdc60cb763b07087c2a704755b1a10e0283994
MD5 6b5234d7637d8f421b5c40958a45f041
SHA1 df79fb04a50022542f61c04de7b7e01dd968c288
SHA512 1a1cb84820a99a12c0b8b4fcd2e27b9f09f4d752e062140cc21823ed9aff087362008c87df46648fdf74bafa64e338b8db015546fa57d5f831efe8428d0ff59f
TLSH
T16331BE109CC9D321A3AEE9A515FB730DDB1DF3079991A02FFC24C04E138D5A6929F56A
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 92c88b2aa9b795da3bb11fc53e651cb0ce29a9533576eaf70ca42a771fc1a623
MD5 79f223650dd7d7d619202559ecf1eb9a
SHA1 a5ab41a25abf95fd83f153f2c19b58a796d30aed
SHA512 8ac398872b1dfa5947158cf3128303c11bbf902ffae076d976e2cdc28ad2ab47fb9c418544787d64c2b5f59aa3bcfc2c07d3d8f6015de5a59ef65050fc0b9b3e
TLSH
T16D418C509CC5D231A26FE9A015BB730DE71DF3135D91E02BFC14C15B234E5EA828F5AA
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 0584c8209d74813427e70bb38e63e8f4019253e3ce1b34d4922ed8e76110d770
MD5 589869b59059e08a23c3b9c8d42e9e14
SHA1 602a5c92d4f154c0501bbe3f193a701733b95b03
SHA512 6dc5ac28b92f0b4f215c724f2eb5bf8bd871c37155d0031aed1513d7261fd6a63cd9d844e81c974d1048e4bcea209abd12d648606853a28078daefb6d5b718f9
TLSH
T1E151AA505CCAD23166AEE5E056A76309D71DF3035A81E01FFC1CC05A234E5EA829F5AA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2796-1-0x00000230BDEC0000-0x00000230BDEC1000-memory.dmp

Download

memory/2796-21-0x00000230BDED0000-0x00000230BDED1000-memory.dmp

Download

memory/2796-4-0x00000230BDEC0000-0x00000230BDEC1000-memory.dmp

Download

memory/2796-5-0x00000230BDED0000-0x00000230BDED1000-memory.dmp

Download