mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Desiree Beck
70f151ebe4
* Update create-mutex.md * Update create-mutex.md * Update README.md * Update README.md * Delete micro-behaviors/process/synchronization.md * Update mbc_summary.md --------- Co-authored-by: brightmt <50853930+brightmt@users.noreply.github.com>
13 KiB
13 KiB
| ID | C0042 |
| Objective(s) | Process |
| Related ATT&CK Techniques | None |
| Version | 2.2 |
| Created | 4 December 2020 |
| Last Modified | 16 September 2024 |
Create Mutex
Malware creates a mutex. Mutexes may be created for synchronization purposes (two or more processes/threads to share a resource).
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Poison Ivy | 2005 | -- | Poison Ivy has a default process mutex, but can be altered at build time. [1] |
| Stuxnet | 2010 | -- | Malware creates global mutexes that signal rootkit installation has occurred successfully. [2] |
| Hupigon | 2013 | -- | Hupigon creates a mutex. [3] |
| Kovter | 2016 | -- | Kovter creates a mutex. [3] |
| Redhip | 2011 | -- | Redhip creates a mutex. [3] |
| Rombertik | 2015 | -- | Rombertik creates a mutex. [3] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| create mutex | Create Mutex (C0042) | kernel32.CreateMutex, kernel32.CreateMutexEx, System.Threading.Mutex::ctor |
| lock file | Create Mutex (C0042) | fcntl |
| Tool: CAPE | Class | Mapping | APIs |
|---|---|---|---|
| banker_zeus_mutex | ZeusMutexes | Create Mutex (C0042) | -- |
| packer_armadillo_mutex | ArmadilloMutex | Create Mutex (C0042) | -- |
| trickbot_mutex | TrickBotMutexes | Create Mutex (C0042) | -- |
| banker_cridex | Cridex | Create Mutex (C0042) | -- |
| deepfreeze_mutex | DeepFreezeMutex | Create Mutex (C0042) | -- |
| bot_russkill | Ruskill | Create Mutex (C0042) | -- |
| banker_zeus_p2p | ZeusP2P | Create Mutex (C0042) | -- |
| carberp_mutex | CarberpMutexes | Create Mutex (C0042) | -- |
| ransomware_radamant | RansomwareRadamant | Create Mutex (C0042) | -- |
| rat_plugx_mutex | PlugxMutexes | Create Mutex (C0042) | -- |
| rat_spynet | SpynetRat | Create Mutex (C0042) | -- |
| rat_limerat | LimeRATMutexes | Create Mutex (C0042) | -- |
| rat_dcrat | DCRatMutex | Create Mutex (C0042) | -- |
| rat_nanocore | NanocoreRAT | Create Mutex (C0042) | -- |
| bot_russkill | Ruskill | Create Mutex (C0042) | -- |
| rat_fynloski_mutex | FynloskiMutexes | Create Mutex (C0042) | -- |
| ransomware_germanwiper | GermanWiperMutexes | Create Mutex (C0042) | -- |
| rat_xtreme_mutex | XtremeMutexes | Create Mutex (C0042) | -- |
| rat_crat | CRATMutexes | Create Mutex (C0042) | -- |
| cypherit_mutex | CypherITMutexes | Create Mutex (C0042) | -- |
| deepfreeze_mutex | DeepFreezeMutex | Create Mutex (C0042) | -- |
| remcos | RemcosMutexes | Create Mutex (C0042) | -- |
| ransomware_medusalocker | MedusaLockerMutexes | Create Mutex (C0042) | -- |
| rat_blackremote | BlackRATMutexes | Create Mutex (C0042) | -- |
| rat_beebus_mutex | BeebusMutexes | Create Mutex (C0042) | -- |
| rat_poisonivy | PoisonIvyMutexes | Create Mutex (C0042) | -- |
| trojan_ursnif | UrsnifBehavior | Create Mutex (C0042) | -- |
| backdoor_okrum_mutex | OkrumMutexes | Create Mutex (C0042) | -- |
| ransomware_stop | StopRansomMutexes | Create Mutex (C0042) | -- |
| trojan_lokibot_mutex | LokibotMutexes | Create Mutex (C0042) | -- |
| rat_venom | VenomRAT | Create Mutex (C0042) | -- |
| trojan_fleercivet_mutex | FleerCivetMutexes | Create Mutex (C0042) | -- |
| asyncrat_mutex | AsyncRatMutex | Create Mutex (C0042) | -- |
| virus_neshta | NeshtaMutexes | Create Mutex (C0042) | -- |
| virus_renamer_mutex | RenamerMutexes | Create Mutex (C0042) | -- |
| infostealer_raccoon | RaccoonInfoStealerMutex | Create Mutex (C0042) | -- |
| ransomware_gandcrab | GandCrabMutexes | Create Mutex (C0042) | -- |
| downloader_andromut_mutex | AndromutMutexes | Create Mutex (C0042) | -- |
| downloader_phorpiex_mutex | PhorpiexMutexes | Create Mutex (C0042) | -- |
| infostealer_azorult_mutex | AzorultMutexes | Create Mutex (C0042) | -- |
| ransomware_fonix_mutex | FonixMutexes | Create Mutex (C0042) | -- |
| rat_parallax_mutex | ParallaxMutexes | Create Mutex (C0042) | -- |
| ransomware_cryptomix | CryptoMixMutexes | Create Mutex (C0042) | -- |
| downloader_protonbot_mutex | ProtonBotMutexes | Create Mutex (C0042) | -- |
| rat_ratsnif_mutex | RatsnifMutexes | Create Mutex (C0042) | -- |
| ransomware_revil_mutex | RevilMutexes | Create Mutex (C0042) | -- |
| carberp_mutex | CarberpMutexes | Create Mutex (C0042) | -- |
| infostealer_qulab | QulabMutexes | Create Mutex (C0042) | -- |
| banker_geodo | Geodo | Create Mutex (C0042) | -- |
| powerpool_mutex | PowerpoolMutexes | Create Mutex (C0042) | -- |
| rat_quasar | QuasarMutexes | Create Mutex (C0042) | -- |
| ransomware_snake_mutex | SnakeRansomMutexes | Create Mutex (C0042) | -- |
| rat_luminosity | LuminosityRAT | Create Mutex (C0042) | CryptHashData, NtCreateMutant |
| ransomware_nemty | NemtyMutexes | Create Mutex (C0042) | -- |
| banker_cridex | Cridex | Create Mutex (C0042) | -- |
| banker_spyeye_mutex | SpyEyeMutexes | Create Mutex (C0042) | -- |
| ransomware_pysa_mutex | PYSAMutexes | Create Mutex (C0042) | -- |
| packer_armadillo_mutex | ArmadilloMutex | Create Mutex (C0042) | -- |
| targeted_flame | Flame | Create Mutex (C0042) | -- |
| ransomware_satan_mutex | SatanMutexes | Create Mutex (C0042) | -- |
| rat_oblique | ObliquekRATMutexes | Create Mutex (C0042) | -- |
| trickbot_mutex | TrickBotMutexes | Create Mutex (C0042) | -- |
| ransomware_dharma | DharmaMutexes | Create Mutex (C0042) | -- |
| worm_allaple_mutex | AllapleMutexes | Create Mutex (C0042) | -- |
| rat_xpert | XpertRATMutexes | Create Mutex (C0042) | -- |
| rat_pcclient | PcClientMutexes | Create Mutex (C0042) | -- |
C0042 Snippet
Process::Create Mutex
SHA256: 0b8e662e7e595ef56396a298c367b74721d66591d856e8a8241fcdd60d08373c Location: 0x402A1Epush eax ; name of mutex push 0x0 ; if the thread that creates the mutex owns it (false, in this case) push 0x0 ; optional security descriptor set to NULL, so default security descriptor will be used call dword ptr [->KERNEL32.DLL::CreateMutexW] ; call function to create mutex
References
[1] https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
[2] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
[3] capa v4.0, analyzed at MITRE on 10/12/2022