mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
brightmt
3.0 KiB
3.0 KiB
| ID | C0018 |
| Objective(s) | Process |
| Related ATT&CK Techniques | None |
| Version | 2.2 |
| Created | 14 August 2020 |
| Last Modified | 30 April 2024 |
Terminate Process
Malware terminates a process.
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| BlackEnergy | 2007 | -- | BlackEnergy terminates a process via fastfail. [1] |
| GoBotKR | 2019 | -- | GoBotKR terminates processes. [1] |
| GravityRAT | 2018 | -- | GravityRAT terminates processes. [1] |
| Hupigon | 2013 | -- | Hupigon terminates processes. [1] |
| Kovter | 2016 | -- | Kovter terminates processes. [1] |
| Shamoon | 2012 | -- | Shamoon terminates processes. [1] |
| Stuxnet | 2010 | -- | Stuxnet terminates processes. [1] |
| TrickBot | 2016 | -- | TrickBot terminates processes. [1] |
| UP007 | 2016 | -- | UP007 terminates processes. [1] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| check mutex and exit | Terminate Process (C0018) | ExitProcess, exit, _Exit, _exit, WaitForSingleObject, GetLastError |
| terminate process via kill | Terminate Process (C0018) | kill |
| terminate process | Terminate Process (C0018) | System.Diagnostics.Process::Kill, System.Diagnostics.Process::WaitForExit, System.Diagnostics.Process::WaitForExitAsync, System.Environment::Exit, System.Windows.Forms.Application::Exit, kernel32.TerminateProcess, ntdll.NtTerminateProcess, kernel32.ExitProcess |
| Tool: CAPE | Class | Mapping | APIs |
|---|---|---|---|
| terminates_remote_process | TerminatesRemoteProcess | Terminate Process (C0018) | NtTerminateProcess |
C0018 Snippet
Process::Terminate Process
SHA256: 27253651170386863b148afb2a0fdda7780ae65cbc31405acbd99fa06b44b79f Location: 0x1400083c7mov ecx, eax ; use the value stored in eax as the exit status for the exited process call qword ptr [->MSVCRT.DLL::exit] ; call the Windows API function to terminate the process
References
[1] capa v4.0, analyzed at MITRE on 10/12/2022