{
  "family": "killproc",
  "sample_count": 141,
  "category": "trojan",
  "description": "Trojan:Win32/Killproc (commonly documented across security vendor telemetry as Trojan.Win32.KillProc, Win32/Killproc, or Trojan.BAT.KILLPROC) is an aggressive defense evasion utility and auxiliary trojan designed to terminate security software and forensic monitoring tools. Frequently deployed as a pre-execution stage alongside ransomware loaders, banking trojans, and coin miners, Killproc systematically enumerates active processes using the Toolhelp32 API (Process32First/Process32Next) and compares process image names against an extensive embedded blacklist of antivirus engines, endpoint detection and response (EDR) agents, packet capture tools (Wireshark), and system diagnostic utilities (Taskmgr.exe, ProcessHacker). Upon identifying matched processes, Killproc invokes OpenProcess with PROCESS_TERMINATE privileges and executes TerminateProcess to forcefully abort monitoring tools, while executing service control commands (sc.exe stop/config) to disable underlying security services.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Killproc",
    "Trojan:Win32/Killproc",
    "Trojan.Win32.KillProc",
    "Win32/Killproc",
    "Trojan.BAT.KILLPROC",
    "KillProc Trojan",
    "Trojan:Win32/KillProc.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Killproc Trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Killproc is a defense evasion Trojan designed to search for and forcefully terminate antivirus programs, EDR agents, and system monitoring utilities."
      }
    },
    {
      "@type": "Question",
      "name": "Why do threat actors deploy Killproc prior to main payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers deploy Killproc to disable real-time endpoint protection and prevent analysis tools from capturing high-value payloads like ransomware or banking Trojans."
      }
    },
    {
      "@type": "Question",
      "name": "How does Killproc terminate active security processes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The malware iterates through system processes using CreateToolhelp32Snapshot, matches names against an internal blacklist, and calls the TerminateProcess Win32 API."
      }
    },
    {
      "@type": "Question",
      "name": "Does Killproc alter Windows security services?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, many Killproc variants execute service control commands (sc stop, net stop) and alter registry service configurations to prevent security suites from restarting."
      }
    },
    {
      "@type": "Question",
      "name": "How can system administrators defend against Killproc evasion?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Administrators should enable tamper protection on security agents, restrict administrative privileges, and deploy kernel-level endpoint detection (EDR) drivers."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1562.001",
    "T1057",
    "T1489",
    "T1547.001",
    "T1106",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactic": "Impact"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1106",
      "name": "Native API",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; the successful termination of an AV process is almost always followed by the execution of a highly destructive payload.",
    "Verify the status of the EDR sensor and Windows Defender; utilize a script to forcefully restart the services if they are stopped.",
    "Capture a full memory image to identify the malware responsible for terminating the processes, especially if it utilized a kernel driver.",
    "If a BYOVD attack is suspected, identify the vulnerable driver (e.g., <code>gdrv.sys</code>) and add its hash to the enterprise blocklist."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is safe simply because you restarted the AV service; the malware likely established persistence and will kill it again.",
    "Avoid ignoring 'Sensor Offline' alerts in the EDR console; they are frequently the first indicator of a KillProc attack."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Defense Evasion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2008,
  "actor": "Various Cybercrime & Ransomware Operators",
  "cve": [
    "CVE-2017-0199",
    "CVE-2018-0802"
  ],
  "d3fend": [
    "D3-EDR",
    "D3-AM",
    "D3-FIM",
    "D3-PSA"
  ],
  "lineage": {
    "derived_from": [
      "Win32 Process Termination Auxiliary Tool Lineage"
    ],
    "variants": [
      "Trojan:Win32/KillProc.A",
      "Trojan.BAT.KILLPROC.H",
      "Trojan.Win32.KillProc.gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2",
      "5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8"
    ],
    "delivery": [
      "Embedded within multi-stage dropper packages",
      "Downloaded by phishing macro documents",
      "Executed by weaponized batch script loaders"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ProcMonitorSvc",
      "Scheduled Task configured to run on system logon"
    ]
  },
  "yara_rules": [
    "rule Trojan_Win32_Killproc { meta: description = \"Detects Killproc defense evasion process terminator\" strings: $s1 = \"TerminateProcess\" $s2 = \"CreateToolhelp32Snapshot\" $s3 = \"Process32Next\" $s4 = \"taskmgr.exe\" $s5 = \"msseces.exe\" condition: uint16(0) == 0x5A4D and 4 of ($s*) }"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/KillProc",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/KillProc"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.KillProc",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Win32.Killproc",
      "url": "https://securelist.com"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}