BeepRAT System Enumeration via WMI Win32_OperatingSystem and CIM_Memory Queries

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects execution of WMI queries against Win32_OperatingSystem and CIM_Memory classes by processes identified as associated with BeepRAT (e.g., HFY.exe or processes within TCC paths). This behavior is characteristic of post-infection system enumeration, hardware ID generation, and environmental keying used in operations such as DragonClone.