8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.bat
Size 1KB
Sample260731-akemrazdna
SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
TLSH
T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	3348	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
3348	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2388	cmd.exe
3348	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3348	cmd.exe
3348	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 3348	2388	cmd.exe	90
PID 3348 wrote to memory of 1120	3348	cmd.exe	93
PID 1120 wrote to memory of 3348	1120	clink_x64.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clink.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\cmd.exe
  cmd.exe /s /k ""C:\Users\Admin\AppData\Local\Temp\clink.bat" inject "
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Executes a command shell one-liner
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Users\Admin\AppData\Local\Temp\clink_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\clink_x64.exe" inject
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.31.8c8e92_ddde27f6\clink_dll_x64.dll
Size 2.8MB
SHA256 1ed66f6c74b091641ddf2dbc52d9b3b3eda929de1da1cac807a50ef75186831f
MD5 c58c1869f5686fb8778feea6b67107f4
SHA1 17abd40e1c1baca1b0eeab2f4d1bdb7da40bb885
SHA512 62c2d81666c441327e12c565ca73559ca432919cf864e1e14e3de42fd40fb2d2a34ee6fbf7a0336ea8f8382a4b34e503d22114736b5707e5948c949bdf9b6d2c
SSDEEP 49152:eUY7ndhDy3JAylW9R7CCXdiCk6i4DOG+FyTibi8WXnPjV5c+:JYjdByjEBCCMCFDOG+FIiKXnPjV5c+
TLSH
T162D59D56F2B906ABC06B8034C9571653E7B1B5994724E7DB13D0827A2F23BF11ABF780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.31.8c8e92_ddde27f6\clink_dll_x64.dll.origin
Size 51B
SHA256 30f357be16b438b012273b6030fdd0aa5dc2002b933b548b51bb3963028084f0
MD5 a74f26fa457f716c83bc194232730b00
SHA1 51df2c0c3eab65330e92110c92bfbdc840e00e14
SHA512 b3f9770f247cdaf3c4bbf89234821e76d10d357ee1fc1b2683830b928255663a46b3cf61275c1334e9e77d8441dfe095bbf272c42c7c5bb2e8c797a2c519089f
TLSH
T13290021052C796190405B4774565564CC571091A2E8637268EA1844862524CAE691201
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 c838e93d714f98a7196e8e90de38d8de389b8820dd34a0239e7477e3a17f1606
MD5 904e354b5add49d200cac0bb3ea85e19
SHA1 047bf9c55b7ff0a7832ef817787cd99fb255fce3
SHA512 a46074139e041f836c8e72239579bc29245bfc5cb2c8dda67d24d2645afe3656fb2a7322fb612386dfc1b311bcbfef03c82f76e814b8d5b43714d9e83a04e4ce
TLSH
T1DB319E009CCAD252A7AED175A0FAB30DE76CFA07ED918027A914D049078E5EB93CF45B
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 b0f1ba33eee17f220036cc152dd8750f1b0aec41f2c233a43353bcb7c63ca96b
MD5 514c5596ada8ddbf4c3a731d2554254a
SHA1 01535bc9291894bb71e2bae96bc76a5d84654c71
SHA512 155a0c5facb9a0bd706faf18c70af4cbc236e62277e7fcad1e294e1ac4fa9b7a38bfce9f704e106ff9886e92124b1a3229c6b72602a9c6847f74d0af096f8512
TLSH
T185419B409CCA9263A66FD171A4BAB30CE71DFA07AD91C027B914D05A174F5EB82CF49B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3348-1-0x0000026DD99B0000-0x0000026DD99B1000-memory.dmp

Download

memory/3348-5-0x0000026DD99C0000-0x0000026DD99C1000-memory.dmp

Download

memory/3348-4-0x0000026DD99B0000-0x0000026DD99B1000-memory.dmp

Download

memory/3348-21-0x0000026DD99C0000-0x0000026DD99C1000-memory.dmp

Download