Malware

StreamEx

StreamEx is a Windows malware family that operates as a DLL-based backdoor with remote command execution capability. It has been observed enumerating running processes, scanning the host for security products such as antivirus and firewall software, and modifying the Windows Registry. For execution, it abuses the signed Windows binary rundll32.exe to invoke an exported function from its DLL, a technique commonly used for proxy execution and defense evasion. StreamEx also establishes persistence by installing a new Windows service that points to its DLL and configuring that service to start automatically at boot. The combination of host discovery, security-tool discovery, registry manipulation, service-based persistence, and remote command execution indicates use in post-compromise operations on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

2 techniques

T1112Modify RegistryEvidence8

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

T1543.003Windows ServiceEvidence3

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence3

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence5

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

T1218.011Rundll32Evidence2

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.

Defense Impairment

1 technique

T1112Modify RegistryEvidence8

Discovery

4 techniques

T1057Process DiscoveryEvidence5

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence9

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1518.001Security Software DiscoveryEvidence3

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

ACTIVITY FEED

Recent activity

18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

18 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Process Discovery, Technique T1057 - Enterprise | MITRE ATT&CK®

Backdoor malware capable of enumerating processes.

mitre attack websiteNews

Oct 21, 2021

Modify Registry, Technique T1112 - Enterprise | MITRE ATT&CK®

Backdoor with Registry modification capability.

mitre attack websiteNews

Jul 8, 2020

Signed Binary Proxy Execution: Rundll32, Sub-technique T1218.011 - Enterprise | MITRE ATT&CK®

Malware/tool using rundll32.exe to invoke an exported function.

mitre attack websiteNews

Mar 8, 2018

Create or Modify System Process: Windows Service, Sub-technique T1543.003 - Enterprise | MITRE ATT&CK®

Backdoor that installs an auto-start service pointing to its DLL for persistence.

+14 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

StreamEx