IOC Report
PumpBot.exe

loading gif

Files

File Path
Type
Category
Malicious
PumpBot.exe
PE32+ executable (console) x86-64, for MS Windows
initial sample
C:\Users\user\AppData\Local\Temp\_MEI52482\VCRUNTIME140.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\_bz2.pyd
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\_decimal.pyd
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\_hashlib.pyd
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\_lzma.pyd
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\_socket.pyd
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\_ssl.pyd
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\base_library.zip
Zip archive data, at least v2.0 to extract, compression method=store
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\libcrypto-1_1.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\libssl-1_1.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\python310.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\select.pyd
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\_MEI52482\unicodedata.pyd
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
\Device\ConDrv
JSON data
dropped
There are 5 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PumpBot.exe
"C:\Users\user\Desktop\PumpBot.exe"
 malicious
C:\Users\user\Desktop\PumpBot.exe
"C:\Users\user\Desktop\PumpBot.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
unknown
http://cacerts.digicert.cot
unknown
https://mahler:8092/site-updates.py
unknown
http://www.robotstxt.org/norobots-rfc.txt
unknown
http://cacerts.digicert.co
unknown
https://www.python.org/download/releases/2.3/mro/.
unknown
https://www.python.org/
unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
unknown
https://www.openssl.org/H
unknown
https://www.python.org/dev/peps/pep-0205/
unknown
https://python.org/dev/peps/pep-0263/
unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
unknown
There are 4 hidden URLs, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2739690A000
heap
page read and write
7FFDA5461000
unkown
page execute read
27395F86000
heap
page read and write
27396B59000
heap
page read and write
27395FE3000
heap
page read and write
2739690D000
heap
page read and write
273968FF000
heap
page read and write
27395FBF000
heap
page read and write
27395F15000
heap
page read and write
7FF7A100A000
unkown
page readonly
27395FAD000
heap
page read and write
27396A50000
direct allocation
page read and write
273968C4000
heap
page read and write
27395F3F000
heap
page read and write
273968E6000
heap
page read and write
27395F8F000
heap
page read and write
27395FF6000
heap
page read and write
22791A78000
heap
page read and write
27396AD4000
direct allocation
page read and write
A924BCE000
stack
page read and write
27395FE3000
heap
page read and write
22791A89000
heap
page read and write
27395F60000
heap
page read and write
27396855000
heap
page read and write
27395F6A000
heap
page read and write
2739690D000
heap
page read and write
22791A89000
heap
page read and write
27395F70000
heap
page read and write
27395F74000
heap
page read and write
27395F73000
heap
page read and write
27395FB4000
heap
page read and write
27395F71000
heap
page read and write
273969BC000
direct allocation
page read and write
27395FEA000
heap
page read and write
27395F92000
heap
page read and write
22791A89000
heap
page read and write
7FFD94538000
unkown
page readonly
27396851000
heap
page read and write
27396944000
heap
page read and write
27395FE3000
heap
page read and write
27395FAB000
heap
page read and write
27396917000
heap
page read and write
7FF7A102C000
unkown
page read and write
27395F8F000
heap
page read and write
27395FF7000
heap
page read and write
27395FA1000
heap
page read and write
7FFD9455D000
unkown
page readonly
27396870000
heap
page read and write
7FF7A102C000
unkown
page read and write
27396864000
heap
page read and write
27396911000
heap
page read and write
7FFD94678000
unkown
page readonly
273968D4000
heap
page read and write
27395F8F000
heap
page read and write
27395F91000
heap
page read and write
27395FDA000
heap
page read and write
7FFDA3711000
unkown
page execute read
27396911000
heap
page read and write
27396AC8000
direct allocation
page read and write
27395FD7000
heap
page read and write
27395FDA000
heap
page read and write
27395FB7000
heap
page read and write
22791A70000
heap
page read and write
7FFDA5477000
unkown
page readonly
27396861000
heap
page read and write
2739690A000
heap
page read and write
273968EF000
heap
page read and write
A9247ED000
stack
page read and write
27395FB4000
heap
page read and write
22791A89000
heap
page read and write
27396851000
heap
page read and write
27395FB4000
heap
page read and write
273968D4000
heap
page read and write
27395F87000
heap
page read and write
7FFD94649000
unkown
page read and write
27395FF6000
heap
page read and write
2739691E000
heap
page read and write
7FF7A101D000
unkown
page read and write
7FF7A102E000
unkown
page readonly
27396AFC000
direct allocation
page read and write
27395FBE000
heap
page read and write
27395FF0000
heap
page read and write
7FF7A100A000
unkown
page readonly
273968EE000
heap
page read and write
7FF7A101D000
unkown
page read and write
7FFDA3727000
unkown
page readonly
7FF7A100A000
unkown
page readonly
27395FBA000
heap
page read and write
2739686E000
heap
page read and write
27395F8C000
heap
page read and write
27396B88000
heap
page read and write
27395F86000
heap
page read and write
27396B8B000
heap
page read and write
27396870000
heap
page read and write
7FFDA4341000
unkown
page read and write
27395FD2000
heap
page read and write
2739690D000
heap
page read and write
27396A90000
direct allocation
page read and write
273960B0000
direct allocation
page read and write
27395E50000
heap
page read and write
7FFD9456F000
unkown
page readonly
A9247DD000
stack
page read and write
27396917000
heap
page read and write
27395FDA000
heap
page read and write
27395FB4000
heap
page read and write
27395FB4000
heap
page read and write
27395FF6000
heap
page read and write
273965F0000
direct allocation
page read and write
7FFDA3733000
unkown
page read and write
2739694D000
heap
page read and write
27396B8C000
heap
page read and write
227918A0000
heap
page read and write
27395F6B000
heap
page read and write
7FF7A0FE1000
unkown
page execute read
7FFDA3710000
unkown
page readonly
E2959ED000
stack
page read and write
27395F86000
heap
page read and write
7FFDA4330000
unkown
page readonly
27395F8D000
heap
page read and write
7FF7A0FE1000
unkown
page execute read
27396AF8000
direct allocation
page read and write
22791A85000
heap
page read and write
7FFDA4342000
unkown
page readonly
27395FFA000
heap
page read and write
27395FB0000
heap
page read and write
27395FDA000
heap
page read and write
7FF7A101D000
unkown
page write copy
27395E40000
heap
page readonly
27396867000
heap
page read and write
27395FD2000
heap
page read and write
273968BB000
heap
page read and write
2739694D000
heap
page read and write
27395F45000
heap
page read and write
27396B79000
heap
page read and write
27395FE4000
heap
page read and write
7FFD94656000
unkown
page readonly
27395F86000
heap
page read and write
27395F84000
heap
page read and write
27395FB1000
heap
page read and write
27395FAB000
heap
page read and write
27395F8F000
heap
page read and write
27395FE3000
heap
page read and write
22791990000
heap
page read and write
27395FB4000
heap
page read and write
27395FE3000
heap
page read and write
27396950000
direct allocation
page read and write
27395FA8000
heap
page read and write
27396B8D000
heap
page read and write
22791A89000
heap
page read and write
27395FB4000
heap
page read and write
7FFDA4331000
unkown
page execute read
27396870000
heap
page read and write
27395F8F000
heap
page read and write
27395FAB000
heap
page read and write
27395FE6000
heap
page read and write
27395F95000
heap
page read and write
2739686F000
heap
page read and write
27395FEC000
heap
page read and write
27395FE2000
heap
page read and write
7FFDA433D000
unkown
page readonly
27395FE8000
heap
page read and write
27395F7E000
heap
page read and write
27396927000
heap
page read and write
2739660C000
direct allocation
page read and write
27395F9D000
heap
page read and write
27395FF6000
heap
page read and write
273968B8000
heap
page read and write
7FF7A0FE1000
unkown
page execute read
27395FB4000
heap
page read and write
27396851000
heap
page read and write
2739691E000
heap
page read and write
22791980000
heap
page readonly
27395FA4000
heap
page read and write
2739691E000
heap
page read and write
27396B08000
direct allocation
page read and write
27395FEA000
heap
page read and write
7FFDA372B000
unkown
page readonly
27395FA4000
heap
page read and write
27396B00000
direct allocation
page read and write
27396850000
heap
page read and write
27395F81000
heap
page read and write
22791A89000
heap
page read and write
27396864000
heap
page read and write
27395FD2000
heap
page read and write
273960A8000
direct allocation
page read and write
27395FA4000
heap
page read and write
27396854000
heap
page read and write
27395F86000
heap
page read and write
E2959E3000
stack
page read and write
27396B50000
heap
page read and write
2739690A000
heap
page read and write
27395FB4000
heap
page read and write
27396927000
heap
page read and write
27395FB0000
heap
page read and write
27396940000
heap
page read and write
27396917000
heap
page read and write
7FFD94231000
unkown
page execute read
273968B8000
heap
page read and write
27396911000
heap
page read and write
27395FB4000
heap
page read and write
27396B62000
heap
page read and write
27395F92000
heap
page read and write
22791C80000
heap
page read and write
273968F7000
heap
page read and write
7FF7A1020000
unkown
page read and write
273969F4000
direct allocation
page read and write
27396864000
heap
page read and write
27395FF5000
heap
page read and write
27396AD8000
direct allocation
page read and write
27396B84000
heap
page read and write
27395F95000
heap
page read and write
22791A89000
heap
page read and write
273968B9000
heap
page read and write
27395F5E000
heap
page read and write
27396878000
heap
page read and write
7FF7A0FE0000
unkown
page readonly
7FFD94230000
unkown
page readonly
27395F7E000
heap
page read and write
273968B8000
heap
page read and write
27395FE3000
heap
page read and write
27395FAD000
heap
page read and write
7FF7A102E000
unkown
page readonly
27395F8A000
heap
page read and write
27396928000
heap
page read and write
273968BB000
heap
page read and write
27395F8C000
heap
page read and write
27395F3F000
heap
page read and write
27395FF7000
heap
page read and write
27395FF9000
heap
page read and write
27395FDA000
heap
page read and write
2739694D000
heap
page read and write
27396870000
heap
page read and write
22791A96000
heap
page read and write
27396AE0000
direct allocation
page read and write
22791A85000
heap
page read and write
7FFD9460C000
unkown
page read and write
27396936000
heap
page read and write
27396855000
heap
page read and write
273960AC000
direct allocation
page read and write
7FF7A101D000
unkown
page write copy
273968BB000
heap
page read and write
27396A00000
direct allocation
page read and write
7FFDA5471000
unkown
page readonly
7FFD94645000
unkown
page read and write
27395F7E000
heap
page read and write
7FF7A0FE1000
unkown
page execute read
273968EE000
heap
page read and write
27395FAB000
heap
page read and write
A9249DE000
stack
page read and write
27396AF4000
direct allocation
page read and write
27395FF5000
heap
page read and write
27395FEB000
heap
page read and write
27396B8A000
heap
page read and write
7FFDA5476000
unkown
page read and write
273968B8000
heap
page read and write
22791A89000
heap
page read and write
27395F5C000
heap
page read and write
273968BB000
heap
page read and write
27396860000
heap
page read and write
22791A89000
heap
page read and write
27395FA4000
heap
page read and write
2739691E000
heap
page read and write
27396927000
heap
page read and write
27395F23000
heap
page read and write
27396B51000
heap
page read and write
27396AA8000
direct allocation
page read and write
27395FD2000
heap
page read and write
27396B5C000
heap
page read and write
27395F9B000
heap
page read and write
27395FD3000
heap
page read and write
227919B0000
heap
page read and write
27395F95000
heap
page read and write
27396857000
heap
page read and write
27395FFB000
heap
page read and write
2739608C000
direct allocation
page read and write
27395FFA000
heap
page read and write
7FF7A0FE0000
unkown
page readonly
7FFD9464C000
unkown
page read and write
22791A89000
heap
page read and write
27396867000
heap
page read and write
27395FB4000
heap
page read and write
27395F5B000
heap
page read and write
2739694D000
heap
page read and write
7FFD9462C000
unkown
page write copy
27395F7E000
heap
page read and write
27396AF0000
direct allocation
page read and write
27395FB5000
heap
page read and write
27395FFC000
heap
page read and write
E295DCF000
stack
page read and write
27395FD2000
heap
page read and write
27396000000
direct allocation
page read and write
27395FD2000
heap
page read and write
273969C4000
direct allocation
page read and write
27395F44000
heap
page read and write
27395FEC000
heap
page read and write
27395F69000
heap
page read and write
27395F96000
heap
page read and write
7FFDA3734000
unkown
page readonly
27395F86000
heap
page read and write
27395F6D000
heap
page read and write
27396B5C000
heap
page read and write
27395FD2000
heap
page read and write
27395D60000
heap
page read and write
27395FFD000
heap
page read and write
27395F88000
heap
page read and write
27395FB0000
heap
page read and write
27395F3C000
heap
page read and write
27396A04000
direct allocation
page read and write
7FFDA5460000
unkown
page readonly
27395FF5000
heap
page read and write
27395FC2000
heap
page read and write
27396917000
heap
page read and write
27395F76000
heap
page read and write
27396B8E000
heap
page read and write
27395F73000
heap
page read and write
27396ACC000
direct allocation
page read and write
27395FDA000
heap
page read and write
273968B8000
heap
page read and write
7FF7A102E000
unkown
page readonly
E295BDF000
stack
page read and write
E2959EA000
stack
page read and write
27396936000
heap
page read and write
27395FB4000
heap
page read and write
27395E70000
heap
page read and write
27395FB4000
heap
page read and write
27396927000
heap
page read and write
7FFD94467000
unkown
page readonly
27395FB7000
heap
page read and write
2739685A000
heap
page read and write
27395FAB000
heap
page read and write
273968D6000
heap
page read and write
273961C0000
heap
page read and write
27395F7E000
heap
page read and write
27396911000
heap
page read and write
273968FE000
heap
page read and write
27395FAE000
heap
page read and write
22791A89000
heap
page read and write
7FF7A0FE0000
unkown
page readonly
27396AAC000
direct allocation
page read and write
27395FF4000
heap
page read and write
27396B04000
direct allocation
page read and write
2739690D000
heap
page read and write
27396930000
heap
page read and write
22791A89000
heap
page read and write
27395FB4000
heap
page read and write
7FF7A102E000
unkown
page readonly
27395FAB000
heap
page read and write
27395F3C000
heap
page read and write
7FF7A0FE0000
unkown
page readonly
27395FB4000
heap
page read and write
27395FDA000
heap
page read and write
27396510000
direct allocation
page read and write
27395FA8000
heap
page read and write
27395FDA000
heap
page read and write
7FF7A100A000
unkown
page readonly
27395FF7000
heap
page read and write
2739685F000
heap
page read and write
27395FB4000
heap
page read and write
27395F00000
heap
page read and write
27395FAD000
heap
page read and write
27395FDA000
heap
page read and write
27395F73000
heap
page read and write
2739690A000
heap
page read and write
27395FE1000
heap
page read and write
22791A89000
heap
page read and write
273968DF000
heap
page read and write
There are 356 hidden memdumps, click here to show them.