Terminate Process

October 2, 2024 ยท View on GitHub

ID C0018
Objective(s) Process
Related ATT&CK Techniques None
Version 2.2
Created 14 August 2020
Last Modified 30 April 2024

Terminate Process

Malware terminates a process.

Use in Malware

NameDateMethodDescription
BlackEnergy2007--BlackEnergy terminates a process via fastfail. [1]
GoBotKR2019--GoBotKR terminates processes. [1]
GravityRAT2018--GravityRAT terminates processes. [1]
Hupigon2013--Hupigon terminates processes. [1]
Kovter2016--Kovter terminates processes. [1]
Shamoon2012--Shamoon terminates processes. [1]
Stuxnet2010--Stuxnet terminates processes. [1]
TrickBot2016--TrickBot terminates processes. [1]
UP0072016--UP007 terminates processes. [1]

Detection

Tool: capaMappingAPIs
check mutex and exitTerminate Process (C0018)ExitProcess, exit, _Exit, _exit, WaitForSingleObject, GetLastError
terminate process via killTerminate Process (C0018)kill
terminate processTerminate Process (C0018)System.Diagnostics.Process::Kill, System.Diagnostics.Process::WaitForExit, System.Diagnostics.Process::WaitForExitAsync, System.Environment::Exit, System.Windows.Forms.Application::Exit, kernel32.TerminateProcess, ntdll.NtTerminateProcess, kernel32.ExitProcess
Tool: CAPEClassMappingAPIs
terminates_remote_processTerminatesRemoteProcessTerminate Process (C0018)NtTerminateProcess

C0018 Snippet

Process::Terminate Process SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f Location: 0x1400083c7 
mov     ecx, eax        ; use the value stored in eax as the exit status for the exited process
call    qword ptr [->MSVCRT.DLL::exit]  ; call the Windows API function to terminate the process

References

[1] capa v4.0, analyzed at MITRE on 10/12/2022