S0210 Nerex

Nerex is a Trojan used by Elderwood to open a backdoor on compromised hosts. ¹ ²

Techniques Used

Domain	ID	Name	Use
enterprise	T1543	Create or Modify System Process	-
enterprise	T1543.003	Windows Service	Nerex creates a Registry subkey that registers a new service.²
enterprise	T1105	Ingress Tool Transfer	Nerex creates a backdoor through which remote attackers can download files onto a compromised host.³
enterprise	T1112	Modify Registry	Nerex creates a Registry subkey that registers a new service.²
enterprise	T1553	Subvert Trust Controls	-
enterprise	T1553.002	Code Signing	Nerex drops a signed Microsoft DLL to disk.²

ID	Name	References
G0066	Elderwood	¹