8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clink.bat
Size 1KB
Sample260824-wvpfla1grf
SHA256 8ce0dab1564dbbc1c5d0bb2984ae7c89986391fe32e2d8d9128e24b13c5b778d
MD5 bc3a35ccbe8b9c80c1ffc3322189d0ea
SHA1 572555e1b5e717f0052e85ff37e584b09ea327d3
SHA512 82f047d34dce02cc8b2efd43d33421b433eeac7df60bb200da1ccb444c01e8b1db81bcedd13fb7f63b5790623172d5228c08a00951cec6ffcfde36a03b08c590
TLSH
T17B311182542E933E19B24943F9B2130AF527D5033757102AB557A0EE7FA31CA90EA1FA
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	4652	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
4652	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4784	cmd.exe
4652	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4652	cmd.exe
4652	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4652	4784	cmd.exe	90
PID 4652 wrote to memory of 3156	4652	cmd.exe	92
PID 3156 wrote to memory of 4652	3156	clink_x64.exe	90

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\clink.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\cmd.exe
  cmd.exe /s /k ""C:\Users\Admin\AppData\Local\Temp\clink.bat" inject "
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Executes a command shell one-liner
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Users\Admin\AppData\Local\Temp\clink_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\clink_x64.exe" inject
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clink_dll_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.32.43da05_ddde27f6\clink_dll_x64.dll
Size 2.8MB
SHA256 a7ee021b3ff12d730fe05a3024168cbd5c599605db02a8ca71c0f70062c304f8
MD5 b4f3e16ac380a4b5346f55ed0334ad97
SHA1 6edbf4ed349ad8d1d690bcd59d6a277c32f5e8fe
SHA512 7ac861dd43d22915a3f3227476c050b89093986e9780646e8ff29fc09961c9a48e8f72341521575177fc7977e2f94c0600e1807a30583785c880975468a5a4ce
SSDEEP 49152:XETkWHk03Prrt0X5ZJebIuBAbOl1gjydG+6Wut:0Tke7PaPJVEqO0wG+4
TLSH
T100D59D47F2B906AAC06B8034C9571657E7B1B59A4725E7DB13D0827A1F23BF12A7F380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clink_dll_x64.dll.origin

Path C:\Users\Admin\AppData\Local\Temp\clink\dll_cache\1.9.32.43da05_ddde27f6\clink_dll_x64.dll.origin
Size 51B
SHA256 30f357be16b438b012273b6030fdd0aa5dc2002b933b548b51bb3963028084f0
MD5 a74f26fa457f716c83bc194232730b00
SHA1 51df2c0c3eab65330e92110c92bfbdc840e00e14
SHA512 b3f9770f247cdaf3c4bbf89234821e76d10d357ee1fc1b2683830b928255663a46b3cf61275c1334e9e77d8441dfe095bbf272c42c7c5bb2e8c797a2c519089f
TLSH
T13290021052C796190405B4774565564CC571091A2E8637268EA1844862524CAE691201
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 1KB
SHA256 7deb3a14eb5ddda37fa69cea89363945d40c42050ebd995e37e30a14da46169f
MD5 df0c388fc9f9c5ba3c39d15d921021da
SHA1 86a6ec443012610e7bc5aa14652839fc345050ca
SHA512 d22ee44019787c07e281f81c45a30aa2eeed871fe1be8ce794df30b54d96f681b683ca66bf1d07bf5740c88afd57a2424b0afcaf6733f8b1ecb099ffb628aea0
TLSH
T13F3188008C8AD211A3AEC76154FB734ED75AF2179E80C02BBC24D54A238E1B6D3CF54B
MD5 SHA1 SHA512 TLSH

Submit Download

clink.log

Path C:\Users\Admin\AppData\Local\clink\clink.log
Size 2KB
SHA256 4685eb5a7fad309f8d4c629b950c89b182502b27d9d98b480c7d06c51580d900
MD5 57dde5b0ebe288b91da2225d3eeb80ea
SHA1 e3b30d908d70b7a6f19c25044a54bf583c17fda9
SHA512 e3f51b24ce22fedd69eddc19867ae420b1848123ef6bc638a3245a49e4becbf8f33749b8b53414d424a18fe19a03196c33e18c08e3b45cc0fa26b872052ab13d
TLSH
T1EC4169409C8AD221A36BC66114BB734EE75AF2138E90D02BBC24D55A775F0FAC38F55B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4652-1-0x0000028DC4990000-0x0000028DC4991000-memory.dmp

Download

memory/4652-21-0x0000028DC49A0000-0x0000028DC49A1000-memory.dmp

Download

memory/4652-5-0x0000028DC49A0000-0x0000028DC49A1000-memory.dmp

Download

memory/4652-4-0x0000028DC4990000-0x0000028DC4991000-memory.dmp

Download