Overview

overview

7

Static

static

3

Nimble.Kic...in.exe

windows10-2004-x64

7

Nimble.Kic...in.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260630-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/06/2026, 16:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Nimble.Kick.1.1.0.x64.VST3.Win.exe
  • Size 6.0MB
  • Sample260630-tkfdtsbv5l
  • SHA256 50a87a661246b8c818651af7a9e9097a07e39eac88c3be6cfac957f3346daf73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 11 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nimble.Kick.1.1.0.x64.VST3.Win.exe
    "C:\Users\Admin\AppData\Local\Temp\Nimble.Kick.1.1.0.x64.VST3.Win.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1648
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 39F51A9FBE8492BC8D49C33BA9DF844C C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4188

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PrepareDlgProgress.gif
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\PrepareDlgProgress.gif
        • Size 17KB
        • SHA256 d61df7845f215d669f13710f7c28647139ee4a1a3c64a4488c961e4139a89d66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        applogoicon.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\applogoicon.bmp
        • Size 19KB
        • SHA256 83ffced8a99bd30a31562c9b40d1542a7abadffd5146081fed705f46a7a2d1d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        backbutton
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\backbutton
        • Size 1KB
        • SHA256 70e09a8fd88ccc7f56f77a03f43de9d8410c250d58982573bbbcc5d56364b50d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        background
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\background
        • Size 776KB
        • SHA256 073f5d8e8ffba1b9c674a71ce82cc59b7dd01f9aca40b161ceb4de8ee645ae75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        backgroundprepare
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\backgroundprepare
        • Size 136B
        • SHA256 6712f037367685d33893b9b577b5f6bce188c492ec878cb2d0fb78777c695281
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frame_right_inactive.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\frame_right_inactive.bmp
        • Size 68B
        • SHA256 4e0a79cef8bbdaa13d0b6bb700e70cd29f2cf878313bd2c9aaa7dcb0c1bcdc89
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frame_top_left.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\frame_top_left.bmp
        • Size 156B
        • SHA256 4afcdfa0cdfd03b054c5b0280b41e9a3fcdd31f197af23e22a908f88414bc756
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        frame_top_mid_inactive.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\frame_top_mid_inactive.bmp
        • Size 68B
        • SHA256 42aec2aaa58c0cbb3f585e7358324aabee0bd5083d13e66347c9c8413bb15dc2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        metrorunapplicationbutton
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\metrorunapplicationbutton
        • Size 5KB
        • SHA256 3d053163aaaaee4dc3a5e89672e39ea223f86653a4faa31bc59cb42e855496ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        modify.png
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\modify.png
        • Size 2KB
        • SHA256 77073e43110193409667071a3e96493eaeee66f89dd147bc19951a4105e705ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nextcancelbuttons
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_1648\nextcancelbuttons
        • Size 1KB
        • SHA256 6a7d0e588fa0ca45f2daeaa36a86e2b0e8502fe105efbe6856e1e91c9528d889
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSIC5BD.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSIC5BD.tmp
        • Size 436KB
        • SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSIC67A.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSIC67A.tmp
        • Size 897KB
        • SHA256 519f7ac72beba9d5d7dcf71fcac15546f5cfd3bcfc37a5129e63b4e0be91a783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Nimble Kick.x64.msi
        • Path C:\Users\Admin\AppData\Roaming\Nimble Tools\Nimble Kick 1.1.0\install\FD83D6B\Nimble Kick.x64.msi
        • Size 3.8MB
        • SHA256 e1f579b3abfe2d5795990ad831f61407bd45f125017e050302c528af61bde5c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        decoder.dll
        • Path C:\Users\Admin\AppData\Roaming\Nimble Tools\Nimble Kick 1.1.0\install\decoder.dll
        • Size 205KB
        • SHA256 d4282c9805e7ff97a7bebcbbed608d7daa3dc4c72354690ba94b685550728549
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download