vbc.exe
Sources: 300M+ executions observed in the wild.
Summary
Visual Basic .NET Compiler. Compiles VB.NET source code into assemblies. Abused as a LOLBin to compile and execute arbitrary VB.NET code on the target system.
vbc.exe is the 1910th most commonly executed Windows program in EchoTrail's dataset, observed 352 times across enterprise environments. It typically runs from C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and it is most often launched by w3wp.exe.
Get this in your tools
The same record for vbc.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/vbc.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\Microsoft.NET\Framework64\v4.0.3031985.23%
- C:\Windows\Microsoft.NET\Framework\v4.0.3031914.77%
Top Hashes (SHA256)
- 6ea0a6ddd3eacf8eba6cf5cd0e50aab027cdc204016d6303429cdd73692a0ba582.1%
- 19a3cfbc90e877df30e938fb55785ac3ba8e2e30a54ffbb5af6e0ec9430f9e4b10.8%
- 9c3b38a4eaa6ca031d6295bafdf2586a37684ffcaa23e910347c5cb828e0a9491.99%
- 15dd9dbe3ac4b76b3e224d54d26483d0dfe6a9ef5a2d3b7137d5259565ffacbd1.14%
- d24a4aec99b0ad9263cfc616d35ee2a7845d70f3ab894c8816294bfce7c5b01e1.14%
- 1baea4a35daab07203753fd875d59e4058c2872a03587bf3ff933546a2ef26a80.85%
- 466876f453563a272adb5d568670eca98d805e7ecaa5a2e18c92b6d3c947df930.85%
- 90a0715f0e2b0e4869a83aca689603a437fdb5024ad11c9343160e88d2cd07eb0.85%
- 458653516caaa16bade2e1aec45c4a11d8cd8ac0aef16f768e766e54c036f90a0.28%
Process Ancestry
Top Grandparents
- services.exe79%
- svchost.exe19.67%
Top Children
- cvtres.exe53.99%
- conhost.exe46.01%
Security Analysis
What does vbc.exe normally do?
Runs from .NET Framework directory. Used during .NET builds to compile VB.NET source files. Part of the build toolchain — rarely invoked directly except on developer machines.
When is vbc.exe suspicious?
Execution on non-developer machines. Compiling source files from temp directories or user profile paths. Spawned by unexpected parents (explorer.exe, WmiPrvSE.exe). Compiled output executed immediately after compilation.
How do attackers abuse vbc.exe?
CODE COMPILATION AND EXECUTION: Attackers drop VB.NET source code and use vbc.exe to compile it into an executable or DLL on the target. This avoids bringing a pre-compiled binary that might be detected by AV. The compiled code can be anything — reverse shell, downloader, credential harvester. Similar to csc.exe (C# compiler) but less commonly monitored.
Detection guidance
MEDIUM-CONFIDENCE: - vbc.exe compiling files from %TEMP%, %APPDATA%, or Downloads - vbc.exe on non-developer systems - vbc.exe followed by execution of the compiled output DATA SOURCES: Process creation (Sysmon 1), file creation (Sysmon 11)
False positive notes
Normal on developer workstations. Build servers compile VB.NET code routinely. msbuild.exe invokes vbc.exe during .NET builds.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about vbc.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for vbc.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.