Analysis
- user interaction
yes - max time kernel
61s - max time network
67s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/09/2026, 14:05
General
- Target BeamSplit.exe
- Size 65.1MB
- Sample260903-rd9b8aaj2x
- SHA256 1d5550ced05808f631bfaee675889e1fbeb66c749489372d758988621382c0d3
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 3 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BeamSplit.exe"C:\Users\Admin\AppData\Local\Temp\BeamSplit.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.json
config.json.db34aca1929f46ad989fe00660411d1c.tmp
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/3556-101-0x000001872C410000-0x000001872C430000-memory.dmp
memory/3556-230-0x0000018735940000-0x00000187359C0000-memory.dmp
memory/3556-14-0x0000017F11E80000-0x0000017F120A0000-memory.dmp
memory/3556-19-0x0000017F14740000-0x0000017F148A0000-memory.dmp
memory/3556-50-0x0000017F15940000-0x0000017F15960000-memory.dmp
memory/3556-42-0x0000017F15A10000-0x0000017F15A90000-memory.dmp
memory/3556-54-0x0000017F15960000-0x0000017F15980000-memory.dmp
memory/3556-70-0x0000017F15B30000-0x0000017F15B50000-memory.dmp
memory/3556-81-0x0000018729780000-0x00000187297D0000-memory.dmp
memory/3556-77-0x0000018729680000-0x0000018729780000-memory.dmp
memory/3556-34-0x0000018729FE0000-0x000001872A7D0000-memory.dmp
memory/3556-66-0x0000017F15B80000-0x0000017F15BB0000-memory.dmp
memory/3556-62-0x0000017F15B10000-0x0000017F15B30000-memory.dmp
memory/3556-58-0x0000017F15AB0000-0x0000017F15AD0000-memory.dmp
memory/3556-46-0x0000017F120A0000-0x0000017F120B0000-memory.dmp
memory/3556-38-0x0000017F10140000-0x0000017F10160000-memory.dmp
memory/3556-30-0x0000017F158F0000-0x0000017F15940000-memory.dmp
memory/3556-26-0x0000017F148E0000-0x0000017F14920000-memory.dmp
memory/3556-23-0x0000017F14590000-0x0000017F145E0000-memory.dmp
memory/3556-85-0x000001872CE00000-0x000001872D570000-memory.dmp
memory/3556-89-0x000001872C370000-0x000001872C3A0000-memory.dmp
memory/3556-109-0x000001872C640000-0x000001872C680000-memory.dmp
memory/3556-105-0x0000017F100D0000-0x0000017F100E0000-memory.dmp
memory/3556-6-0x0000017F13020000-0x0000017F13F70000-memory.dmp
memory/3556-117-0x000001872D620000-0x000001872D680000-memory.dmp
memory/3556-125-0x000001872D590000-0x000001872D5A0000-memory.dmp
memory/3556-10-0x0000018728560000-0x0000018729480000-memory.dmp
memory/3556-121-0x000001872D6C0000-0x000001872D700000-memory.dmp
memory/3556-93-0x000001872C3A0000-0x000001872C3C0000-memory.dmp
memory/3556-129-0x000001872D910000-0x000001872D9C0000-memory.dmp
memory/3556-133-0x000001872DA40000-0x000001872DA90000-memory.dmp
memory/3556-98-0x000001872C510000-0x000001872C5D0000-memory.dmp
memory/3556-142-0x000001872E000000-0x000001872E070000-memory.dmp
memory/3556-146-0x000001872D850000-0x000001872D860000-memory.dmp
memory/3556-152-0x0000018733D90000-0x0000018733F60000-memory.dmp
memory/3556-166-0x00000187340D0000-0x0000018734100000-memory.dmp
memory/3556-162-0x0000018733F60000-0x0000018733F80000-memory.dmp
memory/3556-158-0x0000018733800000-0x0000018733810000-memory.dmp
memory/3556-154-0x0000018733B90000-0x0000018733C90000-memory.dmp
memory/3556-194-0x0000018732040000-0x0000018732050000-memory.dmp
memory/3556-198-0x0000018734820000-0x0000018734980000-memory.dmp
memory/3556-202-0x0000018734090000-0x00000187340A0000-memory.dmp
memory/3556-206-0x0000018734C10000-0x0000018734DC0000-memory.dmp
memory/3556-210-0x0000018733770000-0x00000187337F0000-memory.dmp
memory/3556-219-0x00000187351F0000-0x0000018735460000-memory.dmp
memory/3556-214-0x0000018734980000-0x0000018734A20000-memory.dmp
memory/3556-234-0x0000018735470000-0x0000018735490000-memory.dmp
memory/3556-113-0x000001872C5D0000-0x000001872C5F0000-memory.dmp
memory/3556-242-0x0000018735910000-0x0000018735930000-memory.dmp
memory/3556-238-0x00000187359C0000-0x00000187359F0000-memory.dmp
memory/3556-254-0x000001872D9C0000-0x000001872D9D0000-memory.dmp
memory/3556-258-0x0000018737BF0000-0x0000018737D10000-memory.dmp
memory/3556-263-0x0000018737E00000-0x0000018737EF0000-memory.dmp