Analysis
- user interaction
yes - max time kernel
50s - max time network
60s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/09/2026, 14:05
General
- Target BeamSplit.exe
- Size 65.1MB
- Sample260903-rd9b8aaj2x
- SHA256 1d5550ced05808f631bfaee675889e1fbeb66c749489372d758988621382c0d3
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BeamSplit.exe"C:\Users\Admin\AppData\Local\Temp\BeamSplit.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\EnterSkip.pps" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.json
config.json.7087d9ee8db64334a55d5efec48d495a.tmp
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/1276-146-0x000001ED2B030000-0x000001ED2B040000-memory.dmp
memory/1276-202-0x000001ED2D010000-0x000001ED2D020000-memory.dmp
memory/1276-35-0x000001ED22350000-0x000001ED22B40000-memory.dmp
memory/1276-58-0x000001E50CEA0000-0x000001E50CEC0000-memory.dmp
memory/1276-70-0x000001E50DE40000-0x000001E50DE60000-memory.dmp
memory/1276-66-0x000001E50DE90000-0x000001E50DEC0000-memory.dmp
memory/1276-18-0x000001E50CA90000-0x000001E50CBF0000-memory.dmp
memory/1276-54-0x000001E50CD50000-0x000001E50CD70000-memory.dmp
memory/1276-50-0x000001E50CD10000-0x000001E50CD30000-memory.dmp
memory/1276-166-0x000001ED2CEE0000-0x000001ED2CF10000-memory.dmp
memory/1276-42-0x000001E50CE20000-0x000001E50CEA0000-memory.dmp
memory/1276-38-0x000001E509D00000-0x000001E509D20000-memory.dmp
memory/1276-26-0x000001E50CBF0000-0x000001E50CC30000-memory.dmp
memory/1276-77-0x000001ED248F0000-0x000001ED249F0000-memory.dmp
memory/1276-85-0x000001ED254B0000-0x000001ED25C20000-memory.dmp
memory/1276-89-0x000001E50DEE0000-0x000001E50DF10000-memory.dmp
memory/1276-81-0x000001ED21AF0000-0x000001ED21B40000-memory.dmp
memory/1276-101-0x000001ED24AB0000-0x000001ED24AD0000-memory.dmp
memory/1276-113-0x000001ED24C80000-0x000001ED24CA0000-memory.dmp
memory/1276-109-0x000001ED24CF0000-0x000001ED24D30000-memory.dmp
memory/1276-105-0x000001E5083D0000-0x000001E5083E0000-memory.dmp
memory/1276-97-0x000001ED24BB0000-0x000001ED24C70000-memory.dmp
memory/1276-93-0x000001ED24A40000-0x000001ED24A60000-memory.dmp
memory/1276-129-0x000001ED26CC0000-0x000001ED26D70000-memory.dmp
memory/1276-125-0x000001ED26040000-0x000001ED26050000-memory.dmp
memory/1276-121-0x000001ED26170000-0x000001ED261B0000-memory.dmp
memory/1276-117-0x000001ED260D0000-0x000001ED26130000-memory.dmp
memory/1276-133-0x000001ED26DF0000-0x000001ED26E40000-memory.dmp
memory/1276-30-0x000001E50CCC0000-0x000001E50CD10000-memory.dmp
memory/1276-14-0x000001E50C870000-0x000001E50CA90000-memory.dmp
memory/1276-142-0x000001ED26EB0000-0x000001ED26F20000-memory.dmp
memory/1276-6-0x000001E50B570000-0x000001E50C4C0000-memory.dmp
memory/1276-158-0x000001ED2B0F0000-0x000001ED2B100000-memory.dmp
memory/1276-155-0x000001ED2CC70000-0x000001ED2CD70000-memory.dmp
memory/1276-62-0x000001E50CF00000-0x000001E50CF20000-memory.dmp
memory/1276-22-0x000001E509DB0000-0x000001E509E00000-memory.dmp
memory/1276-46-0x000001E50A5F0000-0x000001E50A600000-memory.dmp
memory/1276-162-0x000001ED2BD30000-0x000001ED2BD50000-memory.dmp
memory/1276-194-0x000001ED2CE50000-0x000001ED2CE60000-memory.dmp
memory/1276-198-0x000001ED2E7B0000-0x000001ED2E910000-memory.dmp
memory/1276-151-0x000001ED2CAA0000-0x000001ED2CC70000-memory.dmp
memory/1276-218-0x000001ED2F140000-0x000001ED2F3B0000-memory.dmp
memory/1276-214-0x000001ED2ED20000-0x000001ED2EDC0000-memory.dmp
memory/1276-234-0x000001ED2EE50000-0x000001ED2EE70000-memory.dmp
memory/1276-230-0x000001ED2CF30000-0x000001ED2CFB0000-memory.dmp
memory/1276-206-0x000001ED2EAC0000-0x000001ED2EC70000-memory.dmp
memory/1276-210-0x000001ED2D030000-0x000001ED2D0B0000-memory.dmp
memory/1276-238-0x000001ED2EE90000-0x000001ED2EEC0000-memory.dmp
memory/1276-242-0x000001ED2E260000-0x000001ED2E280000-memory.dmp
memory/1276-10-0x000001ED208D0000-0x000001ED217F0000-memory.dmp
memory/1276-254-0x000001ED2CF20000-0x000001ED2CF30000-memory.dmp
memory/1276-259-0x000001ED2F960000-0x000001ED2FA80000-memory.dmp
memory/1276-264-0x000001ED2FB70000-0x000001ED2FC60000-memory.dmp
memory/1568-275-0x00007FF814F40000-0x00007FF8151A3000-memory.dmp
memory/1568-274-0x00007FF814F40000-0x00007FF8151A3000-memory.dmp
memory/1568-270-0x00007FF7D5080000-0x00007FF7D5090000-memory.dmp
memory/1568-269-0x00007FF81509F000-0x00007FF8150A0000-memory.dmp
memory/1568-267-0x00007FF7D5080000-0x00007FF7D5090000-memory.dmp
memory/1568-271-0x00007FF7D5080000-0x00007FF7D5090000-memory.dmp
memory/1568-272-0x00007FF814F40000-0x00007FF8151A3000-memory.dmp
memory/1568-266-0x00007FF7D5080000-0x00007FF7D5090000-memory.dmp
memory/1568-268-0x00007FF7D5080000-0x00007FF7D5090000-memory.dmp
memory/1568-276-0x00007FF814F40000-0x00007FF8151A3000-memory.dmp
memory/1568-273-0x00007FF814F40000-0x00007FF8151A3000-memory.dmp
memory/1568-277-0x00007FF7D2D90000-0x00007FF7D2DA0000-memory.dmp
memory/1568-279-0x00007FF7D2D90000-0x00007FF7D2DA0000-memory.dmp
memory/1568-281-0x00007FF814F40000-0x00007FF8151A3000-memory.dmp
memory/1568-282-0x00007FF814F40000-0x00007FF8151A3000-memory.dmp
memory/1568-280-0x00007FF814F40000-0x00007FF8151A3000-memory.dmp
memory/1568-278-0x00007FF814F40000-0x00007FF8151A3000-memory.dmp