Malware

Nerex

Nerex is Windows malware associated with Windows service registration for persistence. It creates a Registry subkey that registers a new service, indicating use of service-based autostart mechanisms to maintain execution across reboots. The available information supports only this persistence behavior on Windows systems; additional capabilities, delivery vectors, malware classification, and actor associations are not currently available from the supplied facts.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

2 techniques

T1112Modify RegistryEvidence8

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

T1543.003Windows ServiceEvidence7

Catchamas creates three Registry keys to establish persistence by adding a Windows Service ... TEARDROP modified the Registry to create a Windows service for itself ... NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence7

Defense Impairment

2 techniques

T1112Modify RegistryEvidence8

T1553.002Code SigningEvidence2

The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Modify Registry, Technique T1112 - Enterprise | MITRE ATT&CK®

Trojan that creates Registry subkeys to register a new service.

mitre attack websiteNews

Mar 8, 2018

Create or Modify System Process: Windows Service, Sub-technique T1543.003 - Enterprise | MITRE ATT&CK®

Malware that registers a new Windows service via Registry subkeys.

mitre attack websiteNews

Mar 20, 2015

Modify Registry, Technique T1112 - Enterprise | MITRE ATT&CK®

Malware that creates Registry subkeys to register services.

mitre attackNews

Jan 25, 2026

Modify Registry, Technique T1112 - Enterprise | MITRE ATT&CK®

Malware that registers a new service via Registry subkeys (persistence).

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Nerex