Enc-Mac (AES CTR+CBC) mixing AES-256 and AES-128 and splitting keys I'm looking to accomplish a Enc-then-Mac approach using
AES-CTR
and
ECBC-MAC

Now ECBC-MAC requires 2 distinct keys, one for the MAC, and one to encrypt the Tag.

If I do this:
Use AES256-CTR for the encryption.
Then split the AES256 key into 2, and use each 128 bit key to do
AES-128-CBC-MAC
and
Encrypt the Tag using AES-128.

Is this semantically secure? Or do I definitely need 3 distinct keys?
Don't share keys (or derive new keys with a simple method like splitting the original key) for different purposes. If you can't generate truly seperate keys, get a "master key" and derive two keys for encryption and MAC with a strong hash function.

Sharing a key for encryption and authentication with ECBC-MAC is really bad. Splitting the key to generate new ones sounds insecure, but it could also be secure - do you know it? In any case your scheme will break totally if an attacker learn either your encryption or MAC key. That itself is already bad, but with your scheme it's really simple to get the respective other key, compromising both.