NtCreateMutant

Prototype

NTSTATUS NtCreateMutant(
  PHANDLE            MutantHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  BOOLEAN            InitialOwner
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 BA 00 00 00      mov eax, 0xBA
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Backed by `KeInitializeMutant` inside ntoskrnl.exe. Unlike events, the SSN *drifts* across builds (`0xA7` on 1507 up to `0xBA` on Win11 24H2 / Server 2025), so any direct-syscall implementation needs dynamic resolution. A mutant is owned by exactly one thread at a time and supports recursive acquisition; it becomes abandoned (return `STATUS_ABANDONED_WAIT_0`) if the owner thread exits without releasing — a crash-resilient IPC property. The Win32 `CreateMutex` family ultimately calls this routine.

Common malware usage

Single-instance enforcement is the canonical use: at startup the implant calls `NtCreateMutant` with a hardcoded or hash-derived name; if `GetLastError == ERROR_ALREADY_EXISTS` (or in NT terms `STATUS_OBJECT_NAME_COLLISION`), an existing instance is running and the new one exits. Public IOC catalogs (Emotet, TrickBot, Qakbot, IcedID, NotPetya, Ryuk, Conti) include hundreds of family-specific mutex names for exactly this reason. Secondary use is intra-process lock primitive between worker modules, and as a sandbox probe (some sandboxes pre-create known mutex names to elicit early exit).

Detection opportunities

Sysmon Event ID 1 / 11 do not capture mutex creation directly; Sysmon configurations can include `<RuleGroup>` matches on `OriginalFileName` plus correlate via ETW. The high-value telemetry is ETW `Microsoft-Windows-Kernel-Object` enabled with `Mutant` keyword, or `EvtxEcmd` parsing of Object Manager handle audits when SACLs are placed on `\BaseNamedObjects\<family-name>`. Mutex-name IOCs remain one of the cheapest, longest-lived detection avenues for commodity malware — Yara rules across memory or strings still catch most droppers.

Direct syscall examples

; Direct syscall stub for NtCreateMutant (SSN 0xBA on Win11 24H2 / Server 2025)
NtCreateMutant PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 0BAh         ; SSN (24H2 — resolve dynamically for portability)
    syscall
    ret
NtCreateMutant ENDP

// Refuse to run a second copy. Family-specific mutex name kept in cleartext for clarity.
UNICODE_STRING name;
RtlInitUnicodeString(&name, L"\\BaseNamedObjects\\Global\\{8B4E4-implant-singleton}");
OBJECT_ATTRIBUTES oa;
InitializeObjectAttributes(&oa, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);

HANDLE  h = NULL;
NTSTATUS st = NtCreateMutant(&h, MUTANT_ALL_ACCESS, &oa, FALSE);
if (st == STATUS_OBJECT_NAME_COLLISION) { ExitProcess(0); }  // already running

// Cargo: windows-sys = "0.59" (Win32_System_Threading)
use windows_sys::Win32::System::Threading::CreateMutexW;
use windows_sys::Win32::Foundation::{GetLastError, ERROR_ALREADY_EXISTS};
use windows_sys::core::w;
use std::ptr::null;

unsafe fn singleton() -> bool {
    let h = CreateMutexW(null(), 0, w!("Global\\{my-implant-singleton}"));
    !h.is_null() && GetLastError() != ERROR_ALREADY_EXISTS
}

MITRE ATT&CK mappings

• T1480Execution Guardrailsmitre ↗
• T1106Native APImitre ↗
• T1497Virtualization/Sandbox Evasionmitre ↗