Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.1 While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes.2 By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.3 In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.45 Mutex names may be hard-coded or dynamically generated using a predictable algorithm.6
- Microsoft Mutexes
- Microsoft Mutexes
- Sans Mutexes 2012
- Intezer RedXOR 2021
- Deep Instinct BPFDoor 2023
- ICS Mutexes 2015
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0082 | APT38 | DPRK |
| grp_g0094 | Kimsuky | DPRK |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.