Windows Process Execution: more.com spawning vbc.exe (Lummac stealer behavior)

title: "Windows Process Execution: more.com spawning vbc.exe (Lummac stealer behavior)"
id: 59bfc4a5-6efa-4c27-9e64-d65ccbb86436
status: experimental
description: This rule flags instances where a process named more.com spawns a child process matching vbc.exe (original file name vbc.exe). This behavior is relevant because droppers and stealers may use a legitimate-looking binary as a payload host to achieve stealth or code execution. It relies on Windows process creation telemetry, including parent and child image paths and the child process OriginalFileName field.
references:
  - https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files
  - https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef
  - https://strontic.github.io/xcyclopedia/library/more.com-EDB3046610020EE614B5B81B0439895E.html
  - https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/Lummac-Stealer/proc_creation_win_malware_lummac_more_vbc.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-12-19
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \more.com
  selection_child:
    - Image|endswith: \vbc.exe
    - OriginalFileName: vbc.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 19b3806e-46f2-4b4c-9337-e3d8653245ea
    type: derived