Lummac Stealer Activity - Execution Of More.com And Vbc.exe

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•22

Detects the execution of 'more.com' as a parent process and 'vbc.exe' as a child process. This specific process tree behavior has been observed in samples related to the Lummac Stealer, where the Lummac payload is injected into the 'vbc.exe' process.