Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 12:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Ksword5.1/x64/Release/KswordARKLight.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ksword5.1/x64/Release/KswordARKLight.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
KswordARKLight/generated/KswordARK.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Ksword5.1/x64/Release/KswordARKLight.exe
- Size 11.2MB
- Sample261030-p2a38aef53
- SHA256 fdeb11b4879ccf61637acb6fee0b5ce3270c8d31e818afbf24df64e5a289d036
- MD5 b215a61e1ad917dcf676b99c4e56d869
- SHA1 74375ae871c0256c59e1a4544fc8e311c9ca10cf
- SHA512 59f295ec7f1fc138b3ac3470f141075be64b7ae37bbe8cc2a491a748de1b948587ec73ae8347757c4a07a2334ecf4275477c8d8ec2caa5b6c6f573f616e337a5
- SSDEEP 98304:SB0rGiC+Vrd76hz5QBwWrgcAbv+FThut:SB0KHcrd7g9QBwWrBAbv+FTi
- TLSH T12CC63905B29115BAD0EADBF8CE668532E73274F50332A6FB3891425E1FD36E18D3B611
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe 5160 KswordARKLight.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5160 KswordARKLight.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 5160 KswordARKLight.exe Token: SeLoadDriverPrivilege 5160 KswordARKLight.exe Token: SeBackupPrivilege 5160 KswordARKLight.exe Token: SeRestorePrivilege 5160 KswordARKLight.exe Token: SeTakeOwnershipPrivilege 5160 KswordARKLight.exe Token: SeSecurityPrivilege 5160 KswordARKLight.exe Token: SeSystemEnvironmentPrivilege 5160 KswordARKLight.exe Token: SeIncreaseQuotaPrivilege 5160 KswordARKLight.exe Token: SeAssignPrimaryTokenPrivilege 5160 KswordARKLight.exe Token: SeTcbPrivilege 5160 KswordARKLight.exe