{"id":108829,"date":"2025-04-03T17:00:05","date_gmt":"2025-04-03T09:00:05","guid":{"rendered":"https:\/\/version-2.com\/?p=108829"},"modified":"2025-06-18T16:02:25","modified_gmt":"2025-06-18T08:02:25","slug":"adversary-tradecraft-emulating-mustang-pandas-use-of-mavinject-in-recent-campaigns","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2025\/04\/adversary-tradecraft-emulating-mustang-pandas-use-of-mavinject-in-recent-campaigns\/","title":{"rendered":"Adversary Tradecraft: Emulating Mustang Panda\u2019s Use of MAVInject in Recent Campaigns"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>

In cybersecurity, the adage \u201cwhat\u2019s old is new\u201d continues to hold true as attackers resurface longstanding techniques or repurpose them with new twists and adaptations. The popularization of Living Off the Land Binaries (LOLBins) \u2014 legitimate, Windows-native tools commonly abused for malicious uses \u2014 is a great example of this. Many of these methods have existed for decades yet remain effective in the modern security landscape, especially as many organizations are still ill-advised and unequipped to combat them. Being able to spot Mustang Panda\u2019s use of MAVInject in recent campaigns is very important for security teams.<\/p>

\u00a0<\/p>

The LOLBin star for today\u2019s blog is Microsoft Application Virtualization Injector (MAVInject) which is (un)surprisingly still kicking since its first buzz around 2017. We\u2019ll cover its particular role in a novel attack chain reported by Trend Micro<\/a> researchers whereby the threat group Mustang Panda combines legitimate components with malicious payloads to reduce likelihood of detection.<\/p>

\u00a0<\/p>

In this blog we\u2019ll emulate the infection chain described in the report and analyze the activity it produces in Graylog. Throughout and at the end of the post, we share threat hunting and detection approaches that you can apply in your own environments.<\/p>

\u00a0<\/p>

Attack Overview<\/strong><\/h2>

The attack likely starts with a spear-phishing email attachment. When executed by the victim, IRSetup.exe is used to drop multiple files to the system. In the case of the Trend Micro report, the files were placed in a newly created C:\\ProgramData\\session directory.<\/p>

The report\u2019s execution flow diagram seen below shows how the kill chain progresses from the initial dropper all the way to payload execution, ultimately leading to Command and Control (C2) communication to the attacker-controlled server www[.]militarytc[.]com over port 443.<\/p>

\"Attack <\/picture><\/p>

\u00a0<\/p>

Key elements<\/strong><\/h2>