Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\loomDesktop\shell\open\command] '' = '"%LOCALAPPDATA%\Programs\Loom\Loom.exe" "%1"'
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /Fi "IMAGENAME eq Loom Helper"
- '<SYSTEM32>\taskkill.exe' /F /Fi "IMAGENAME eq Loom"
Injects code into
the following user processes:
- loom.exe
Modifies file system
Creates the following files
- %TEMP%\nshbaf6.tmp\system.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-sysinfo-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-conio-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-synch-l1-2-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-synch-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-filesystem-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-console-l1-2-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-interlocked-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-debug-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-errorhandling-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-file-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-file-l2-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-profile-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-memory-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-namedpipe-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-processenvironment-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-processthreads-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-heap-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-datetime-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\loom-recorder-production.exe
- %APPDATA%\loom\crashpad\settings.dat
- %APPDATA%\loom\sentry\scope_v2.json
- %APPDATA%\loom\fontlookuptablecache\font_unique_name_table.pb
- %APPDATA%\loom\storage\current_audio_device.json.1916926871
- %APPDATA%\loom\storage\current_video_device.json.3504810530
- %APPDATA%\loom\storage\selected_audio_devices.json.3380527812
- %HOMEPATH%\desktop\loom.lnk
- %APPDATA%\loom\logs\main.log
- %APPDATA%\loom\storage\selected_video_devices.json.1677086800
- %APPDATA%\loom\gpucache\data_1
- %APPDATA%\loom\gpucache\data_2
- %APPDATA%\loom\gpucache\data_3
- %APPDATA%\loom\cache\index
- %APPDATA%\loom\cache\data_0
- %APPDATA%\loom\cache\data_1
- %APPDATA%\loom\gpucache\index
- %APPDATA%\loom\gpucache\data_0
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\cmdmp3.exe
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\uninstall loom.exe
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\msvcp140.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\msvcp140_1.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\msvcp140_2.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\msvcp140_codecvt_ids.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\ucrtbase.dll
- %APPDATA%\microsoft\windows\start menu\programs\loom.lnk
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\concrt140.dll
- %TEMP%\nshbaf6.tmp\winshell.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\vccorlib140.dll
- %LOCALAPPDATA%\programs\loom\swiftshader\libegl.dll
- %LOCALAPPDATA%\programs\loom\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\programs\loom\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\loom\vulkan-1.dll
- %LOCALAPPDATA%\loom-updater\installer.exe
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\vcruntime140.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\vcruntime140_1.dll
- %LOCALAPPDATA%\programs\loom\resources\elevate.exe
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-console-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\loom.exe
- %LOCALAPPDATA%\programs\loom\libglesv2.dll
- %LOCALAPPDATA%\programs\loom\locales\es-419.pak
- %LOCALAPPDATA%\programs\loom\locales\es.pak
- %LOCALAPPDATA%\programs\loom\locales\et.pak
- %LOCALAPPDATA%\programs\loom\locales\fa.pak
- %LOCALAPPDATA%\programs\loom\locales\fi.pak
- %LOCALAPPDATA%\programs\loom\locales\fil.pak
- %LOCALAPPDATA%\programs\loom\locales\en-gb.pak
- %LOCALAPPDATA%\programs\loom\locales\kn.pak
- %LOCALAPPDATA%\programs\loom\locales\el.pak
- %LOCALAPPDATA%\programs\loom\locales\hi.pak
- %LOCALAPPDATA%\programs\loom\locales\hr.pak
- %LOCALAPPDATA%\programs\loom\locales\hu.pak
- %LOCALAPPDATA%\programs\loom\locales\id.pak
- %LOCALAPPDATA%\programs\loom\locales\it.pak
- %LOCALAPPDATA%\programs\loom\locales\ja.pak
- %LOCALAPPDATA%\programs\loom\locales\gu.pak
- %LOCALAPPDATA%\programs\loom\locales\fr.pak
- %LOCALAPPDATA%\programs\loom\locales\he.pak
- %LOCALAPPDATA%\programs\loom\locales\da.pak
- %LOCALAPPDATA%\programs\loom\licenses.chromium.html
- %TEMP%\nshbaf6.tmp\spiderbanner.dll
- %TEMP%\nshbaf6.tmp\nsprocess.dll
- %TEMP%\nshbaf6.tmp\app-64.7z
- %TEMP%\nshbaf6.tmp\nsis7z.dll
- %LOCALAPPDATA%\programs\loom\chrome_100_percent.pak
- %LOCALAPPDATA%\programs\loom\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\loom\locales\de.pak
- %LOCALAPPDATA%\programs\loom\locales\ko.pak
- %TEMP%\nshbaf6.tmp\stdutils.dll
- %LOCALAPPDATA%\programs\loom\locales\am.pak
- %LOCALAPPDATA%\programs\loom\locales\ar.pak
- %LOCALAPPDATA%\programs\loom\locales\bg.pak
- %LOCALAPPDATA%\programs\loom\locales\bn.pak
- %LOCALAPPDATA%\programs\loom\locales\ca.pak
- %LOCALAPPDATA%\programs\loom\locales\cs.pak
- %LOCALAPPDATA%\programs\loom\license.electron.txt
- %LOCALAPPDATA%\programs\loom\icudtl.dat
- %LOCALAPPDATA%\programs\loom\locales\en-us.pak
- %LOCALAPPDATA%\programs\loom\locales\lt.pak
- %LOCALAPPDATA%\programs\loom\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\loom\resources.pak
- %LOCALAPPDATA%\programs\loom\resources\app-update.yml
- %LOCALAPPDATA%\programs\loom\resources\app.asar
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\application-icons\app-logo.ico
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\sounds\airhorn.mp3
- %LOCALAPPDATA%\programs\loom\locales\vi.pak
- %LOCALAPPDATA%\programs\loom\locales\tr.pak
- %LOCALAPPDATA%\programs\loom\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\sounds\end-recording.mp3
- %LOCALAPPDATA%\programs\loom\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\loom\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\loom\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\loom\ffmpeg.dll
- %LOCALAPPDATA%\programs\loom\libegl.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\sounds\screenshot-camera-shutter.mp3
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\sounds\start-recording.mp3
- %LOCALAPPDATA%\programs\loom\snapshot_blob.bin
- %LOCALAPPDATA%\programs\loom\locales\uk.pak
- %LOCALAPPDATA%\programs\loom\locales\th.pak
- %LOCALAPPDATA%\programs\loom\locales\lv.pak
- %LOCALAPPDATA%\programs\loom\locales\mr.pak
- %LOCALAPPDATA%\programs\loom\locales\ms.pak
- %LOCALAPPDATA%\programs\loom\locales\nb.pak
- %LOCALAPPDATA%\programs\loom\locales\nl.pak
- %LOCALAPPDATA%\programs\loom\locales\pl.pak
- %LOCALAPPDATA%\programs\loom\locales\pt-br.pak
- %LOCALAPPDATA%\programs\loom\locales\pt-pt.pak
- %LOCALAPPDATA%\programs\loom\locales\ml.pak
- %LOCALAPPDATA%\programs\loom\locales\ro.pak
- %LOCALAPPDATA%\programs\loom\locales\sk.pak
- %LOCALAPPDATA%\programs\loom\locales\sl.pak
- %LOCALAPPDATA%\programs\loom\locales\sr.pak
- %LOCALAPPDATA%\programs\loom\locales\sv.pak
- %LOCALAPPDATA%\programs\loom\locales\sw.pak
- %LOCALAPPDATA%\programs\loom\locales\ta.pak
- %LOCALAPPDATA%\programs\loom\locales\te.pak
- %LOCALAPPDATA%\programs\loom\locales\ru.pak
- %APPDATA%\loom\cache\data_2
- %APPDATA%\loom\cache\data_3
Deletes the following files
- %TEMP%\nshbaf6.tmp\app-64.7z
- %TEMP%\nshbaf6.tmp\nsis7z.dll
- %TEMP%\nshbaf6.tmp\nsprocess.dll
- %TEMP%\nshbaf6.tmp\spiderbanner.dll
- %TEMP%\nshbaf6.tmp\stdutils.dll
- %TEMP%\nshbaf6.tmp\system.dll
- %TEMP%\nshbaf6.tmp\winshell.dll
Moves the following files
- from %APPDATA%\loom\storage\current_audio_device.json.1916926871 to %APPDATA%\loom\storage\current_audio_device.json
- from %APPDATA%\loom\storage\current_video_device.json.3504810530 to %APPDATA%\loom\storage\current_video_device.json
- from %APPDATA%\loom\storage\selected_audio_devices.json.3380527812 to %APPDATA%\loom\storage\selected_audio_devices.json
- from %APPDATA%\loom\storage\selected_video_devices.json.1677086800 to %APPDATA%\loom\storage\selected_video_devices.json
Network activity
Connects to
- 'ht#######ke.logs.datadoghq.com':443
- 'ic###azip.com':443
- 'ca####e.apple.com':443
TCP
Other
- 'ht#######ke.logs.datadoghq.com':443
- 'ic###azip.com':443
- 'ca####e.apple.com':443
UDP
- DNS ASK ht#######ke.logs.datadoghq.com
- DNS ASK my##.#pendns.com
- DNS ASK ic###azip.com
- DNS ASK ca####e.apple.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Loom'
- ClassName: '' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\programs\loom\loom.exe'
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=crashpad-handler --user-data-dir=%APPDATA%\Loom /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=%APPDATA%\Loom\Crashpad --url=https://o398470.inge...
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=gpu-process --field-trial-handle=1256,13907457679212755056,8182311117204263249,131072 --enable-features=WebAssemblySimd --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDe...
- '%LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\loom-recorder-production.exe' "{\"type\":\"daemon-start\",\"payload\":{\"daemonOptions\":{\"secret\":\"ad24618da18d43c7b570ed2bc962969d\",\"pipePath\":\"\\\\.\\pipe\\loom_ipc_92801\"}}}"
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1256,13907457679212755056,8182311117204263249,131072 --enable-features=WebAssemblySimd --disable-features=Coo...
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1256,13907457679212755056,8182311117204263249,131072 --enable-features=WebAssemblySimd --disable-features=Cookies...
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1256,13907457679212755056,8182311117204263249,131072 --enable-features=WebAssemblySimd --disable-features=Cookies...
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill.exe /F /Fi "IMAGENAME eq Loom""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill.exe /F /Fi "IMAGENAME eq Loom Helper""' (with hidden window)
- '%LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\loom-recorder-production.exe' "{\"type\":\"daemon-start\",\"payload\":{\"daemonOptions\":{\"secret\":\"ad24618da18d43c7b570ed2bc962969d\",\"pipePath\":\"\\\\.\\pipe\\loom_ipc_92801\"}}}"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill.exe /F /Fi "IMAGENAME eq Loom""
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill.exe /F /Fi "IMAGENAME eq Loom Helper""
