Lion Cipher Lab
Read a sample's mutex and host fingerprint: how malware IDs the machine and avoids double-infection
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Two of the very first things a lot of Windows malware does are so mundane that beginners skip right past them in a report — it creates a named mutex, and it reads a handful of facts about the machine. But those two behaviors answer the two questions the operator most needs answered: 'have I already got this box?' and 'which box is this?' The mutex is a one-line infection marker: create it, and if it already exists, exit — so the malware never runs twice on the same host and never trips over itself. The fingerprint (computer name, user name, machine GUID, volume serial, CPU/BIOS strings,…
What you'll learn
- reading a CreateMutex call in an API trace as a malware infection marker
- understanding the ERROR_ALREADY_EXISTS check that makes malware exit rather than double-infect
- using the mutex name as both a cheap host-based IOC and a vaccination point
- recognising host-fingerprinting APIs: GetComputerName, GetUserName, MachineGuid, volume serial, WMI hardware queries
- seeing how fingerprint fields combine into a single unique bot ID sent to the C2
- reading a locale / keyboard-layout check as an execution guardrail (and an attribution hint)
- mapping the findings to MITRE ATT&CK T1082, T1033, and T1480
- judgment: when the mutex and fingerprint characterise a sample and enable a vaccine, and when they can be fooled (per-build randomisation)
- turning behavioral artifacts into detections and a host inoculation you can deploy
Steps in this lab
- The two mundane behaviors that answer the operator's two big questions
- Your scenario and your artifacts (analyst's chair)
- The API trace — read the mutex as an infection marker
- The mutex as a detection AND a vaccine (and its first limit)
- The fingerprint fields — which API produced each fact
- The decoded bot-ID — how the fields become one identifier
- The locale guardrail — refuse to run in certain countries
- The judgment: when the mutex + fingerprint win, when they're fooled, and how a pro finishes