Killproc
Table of Contents
Overview
Trojan:Win32/Killproc (commonly documented across security vendor telemetry as Trojan.Win32.KillProc, Win32/Killproc, or Trojan.BAT.KILLPROC) is an aggressive defense evasion utility and auxiliary trojan designed to terminate security software and forensic monitoring tools. Frequently deployed as a pre-execution stage alongside ransomware loaders, banking trojans, and coin miners, Killproc systematically enumerates active processes using the Toolhelp32 API (Process32First/Process32Next) and compares process image names against an extensive embedded blacklist of antivirus engines, endpoint detection and response (EDR) agents, packet capture tools (Wireshark), and system diagnostic utilities (Taskmgr.exe, ProcessHacker). Upon identifying matched processes, Killproc invokes OpenProcess with PROCESS_TERMINATE privileges and executes TerminateProcess to forcefully abort monitoring tools, while executing service control commands (sc.exe stop/config) to disable underlying security services.
Known aliases
Threat reports may refer to this family under multiple names:
Family Pedigree & Lineage
Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:
Derived From / Upstream Ancestry: Win32 Process Termination Auxiliary Tool Lineage
Known Derivatives & Downstream Variants: Trojan:Win32/Killproc.A · Trojan.Bat.Killproc.H · Trojan.Win32.Killproc.Gen
MITRE ATT&CK Techniques
Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:
| Technique | Name | Tactic | Official Spec |
|---|---|---|---|
T1562.001 | Impair Defenses: Disable or Modify Tools | Defense Evasion | ATT&CK ↗ |
T1489 | Service Stop | Impact | ATT&CK ↗ |
T1059.003 | Command and Scripting Interpreter: Windows Command Shell | Execution | ATT&CK ↗ |
T1068 | Exploitation for Privilege Escalation | Privilege Escalation | ATT&CK ↗ |
T1106 | Native API | Execution | ATT&CK ↗ |
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.
MITRE D3FEND™ Defensive Countermeasures
Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):
| D3FEND ID | Countermeasure Name | Tactic | Countered ATT&CK | Defensive Guidance |
|---|---|---|---|---|
D3-PBA | Process Spawn Analysis | Detect | T1059.003 | Inspect command-line arguments and anomalous parent-child relationships spawning from cmd.exe. |
D3-KPA | Kernel Patching & Privilege Auditing | Harden | T1068 | Enforce rapid OS kernel patch cycles and deploy Exploit Guard protections to block memory corruption and elevation exploits. |
D3-SCA | System Call Analysis | Detect | T1106 | Leverage kernel-mode EDR sensors to detect unhooked direct system calls (Syscalls) designed to circumvent user-mode API monitoring. |
D3-SPP | Service Protection Policies | Harden | T1489 | Configure strict DACLs on Windows Service Control Manager to prevent unauthorized termination of antivirus and backup services. |
D3-STA | Security Tool Anti-Tamper Enforcement | Harden | T1562.001 | Block unauthorized modification of antivirus registry flags and prevent stopping security agent services. |
Indicators of Compromise
Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.
File hashes (SHA-256, sample)
Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.
c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f25e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8
Delivery vectors
Embedded within multi-stage dropper packagesDownloaded by phishing macro documentsExecuted by weaponized batch script loaders
Persistence mechanisms
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ProcMonitorSvcScheduled Task configured to run on system logon
Tiered Detection Rules (Cisco CAIRN Model)
Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:
Tier 1 Primitive Artifact Rule (Fast Triage)
Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.
rule MALWARE_WIN_KILLPROC_T1_ARTIFACT {
meta:
description = "Tier 1 Primitive Artifact: Raw string matches for Killproc"
tier = "T1 - Primitive Artifact"
confidence = "Low-Medium (Fast Triage)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
$s1 = "killproc" ascii wide nocase
$s2 = "killproc" ascii wide nocase
$s3 = "trojan:win32/killproc" ascii wide nocase
$s4 = "trojan.win32.killproc" ascii wide nocase
$s5 = "win32/killproc" ascii wide nocase
$s6 = "trojan.bat.killproc" ascii wide nocase
$s7 = "killproc trojan" ascii wide nocase
$s8 = "trojan:win32/killproc.a" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Tier 2 Behavioral Context Rule (Process Chains & Sigma)
Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.
title: SystemHelpDesk Detection - Killproc (Trojan) Execution & Triage
id: 62971096-6648-53f2-a465-84191f8aabcc
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
with the Killproc malware family. Detects suspicious execution from temporary user
directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/killproc
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1562_001
- attack.t1057
- attack.t1489
- attack.t1547_001
- attack.t1106
logsource:
category: process_creation
product: windows
detection:
selection_process:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
CommandLine|contains:
- AppData\Local\Temp
- -WindowStyle Hidden
- /e:jscript
- bitsadmin /transfer
condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: mediumTier 3 Attribution Fingerprint Rule (High Fidelity)
Deep signature matching distinctive operational fingerprints and payload characteristics.
rule MALWARE_WIN_KILLPROC_T3_ATTRIBUTION {
meta:
description = "Tier 3 Attribution Fingerprint: Heuristic detection for Killproc tradecraft"
tier = "T3 - Attribution Fingerprint"
confidence = "High (Confirmed Family Signature)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
// Core family identifier & heuristic payload signatures
$attrib_str = "killproc" ascii wide nocase
$pe_magic = "MZ" ascii
$net_marker = "http" ascii nocase
condition:
uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}Containment & Response Steps
Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.
- Immediately isolate the endpoint; the successful termination of an AV process is almost always followed by the execution of a highly destructive payload.
- Verify the status of the EDR sensor and Windows Defender; utilize a script to forcefully restart the services if they are stopped.
- Capture a full memory image to identify the malware responsible for terminating the processes, especially if it utilized a kernel driver.
- If a BYOVD attack is suspected, identify the vulnerable driver (e.g., <code>gdrv.sys</code>) and add its hash to the enterprise blocklist.
What to Avoid
Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.
- Do not assume the endpoint is safe simply because you restarted the AV service; the malware likely established persistence and will kill it again.
- Avoid ignoring 'Sensor Offline' alerts in the EDR console; they are frequently the first indicator of a KillProc attack.
References & External Analysis
- Microsoft Defender Security Intelligence - Trojan:Win32/KillProc
- Trend Micro Threat Encyclopedia - Trojan.Win32.KillProc
- Kaspersky Threat Intelligence - Trojan.Win32.Killproc
- Search "killproc" on VirusTotal (External Analysis)
- Search "killproc" on Any.Run (Sandbox Sandbox)
- Search "killproc" on MalwareBazaar (Malware Samples)
Frequently Asked Questions
What is the Killproc Trojan?
Killproc is a defense evasion Trojan designed to search for and forcefully terminate antivirus programs, EDR agents, and system monitoring utilities.
Why do threat actors deploy Killproc prior to main payloads?
Attackers deploy Killproc to disable real-time endpoint protection and prevent analysis tools from capturing high-value payloads like ransomware or banking Trojans.
How does Killproc terminate active security processes?
The malware iterates through system processes using CreateToolhelp32Snapshot, matches names against an internal blacklist, and calls the TerminateProcess Win32 API.
Does Killproc alter Windows security services?
Yes, many Killproc variants execute service control commands (sc stop, net stop) and alter registry service configurations to prevent security suites from restarting.
How can system administrators defend against Killproc evasion?
Administrators should enable tamper protection on security agents, restrict administrative privileges, and deploy kernel-level endpoint detection (EDR) drivers.
How do I remove the Killproc Trojan from Windows?
Manual removal of Killproc is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Killproc a virus or a Trojan?
Killproc is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Killproc typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Killproc infection?
Symptoms of Killproc can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Protect Your Network Against Trojans
Want to prevent Killproc and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection for Businesses.
📣 Threat Intel Correction or Update?
Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.
Machine-readable
Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/killproc.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.