Sub-technique of T1480 Execution Guardrails.View on attack.mitre.org
Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.
While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes. By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.
In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.
Mutex names may be hard-coded or dynamically generated using a predictable algorithm.
Rules on DetectionCode tagged with T1480.002.
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT38 | APT38 has created a mutex to avoid duplicate execution. |
| GroupKimsuky | Kimsuky has utilized a mutex to detect whether its malware is actively running on the victim host. Kimsuky has leveraged PowerShell to store the Process ID (PID) of the currently running malicious PowerShell script into a file named pid.txt which is saved locally on the victim host in the %TEMP% Directory and is queried prior to execution of subsequent PowerShell script to prevent duplication. |
| Used by | Procedure example |
|---|---|
| MalwareBlack Basta | Black Basta will check for the presence of a hard-coded mutex `dsajdhas.0` before executing. |
| MalwareBPFDoor | When executed, BPFDoor attempts to create and lock a runtime file, `/var/run/initd.lock`, and exits if it fails using the specified file, resulting in a makeshift mutex. |
| MalwareCLAIMLOADER | CLAIMLOADER has created hardcoded mutex to ensure only a single instance of the malware is running. |
| MalwareEmbargo | Embargo has utilized a hardcoded mutex name of “LoadUpOnGunsBringYourFriends” using the `CreateMutexW()` function. Embargo has also utilized a hardcoded mutex name of “IntoTheFloodAgainSameOldTrip." |
| MalwareGazer | Gazer creates a mutex using the hard-coded value `{531511FA-190D-5D85-8A4A-279F2F592CC7}` to ensure that only one instance of itself is running. |
| MalwareGrimAgent | GrimAgent uses the last 64 bytes of the binary to compute a mutex name. If the generated name is invalid, it will default to the generic `mymutex`. |
| MalwareHiddenFace | HiddenFace can create a mutex to ensure only one instance is running at a time. |
| MalwareLockBit 3.0 | LockBit 3.0 can create and check for a mutex containing a hash of the `MachineGUID` value at execution to prevent running more than one instance. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
