Sigma rule: Lummac Stealer Activity - Execution Of More.com And Vbc.exe

Rule

Title

Lummac Stealer Activity - Execution Of More.com And Vbc.exe

Status

experimental

Level

high

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Date

2024-12-19

File

rules-emerging-threats/2024/Malware/Lummac-Stealer/proc_creation_win_malware_lummac_more_vbc.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of more.com and vbc.exe in the process tree.
This behavior was observed by a set of samples related to Lummac Stealer.
The Lummac payload is injected into the vbc.exe process.

Log source

product

windows

category

process_creation

Detection

# VT Query: behaviour_processes:"C:\\Windows\\SysWOW64\\more.com" behaviour_processes:"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe"
selection_parent:
    ParentImage|endswith: '\more.com'
selection_child:
    - Image|endswith: '\vbc.exe'
    - OriginalFileName: 'vbc.exe'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1055

References

• https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files
• https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef
• https://strontic.github.io/xcyclopedia/library/more.com-EDB3046610020EE614B5B81B0439895E.html
• https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2024/Malware/Lummac-Stealer/proc_creation_win_malware_lummac_more_vbc.yml