vbc.exe

by Microsoft

Development ToolLOLBinmedium risk

Summary

Visual Basic .NET Compiler. Compiles VB.NET source code into assemblies. Abused as a LOLBin to compile and execute arbitrary VB.NET code on the target system.

vbc.exe is the 1910th most commonly executed Windows program in EchoTrail's dataset, observed 352 times across enterprise environments. It typically runs from C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and it is most often launched by w3wp.exe.

1910th

most commonly executed Windows program

352

observed executions

low

statistical confidence

Behavior

Top Paths

C:\Windows\Microsoft.NET\Framework64\v4.0.3031985.23%
C:\Windows\Microsoft.NET\Framework\v4.0.3031914.77%

Top Hashes (SHA256)

6ea0a6ddd3eacf8eba6cf5cd0e50aab027cdc204016d6303429cdd73692a0ba582.1%
19a3cfbc90e877df30e938fb55785ac3ba8e2e30a54ffbb5af6e0ec9430f9e4b10.8%
9c3b38a4eaa6ca031d6295bafdf2586a37684ffcaa23e910347c5cb828e0a9491.99%
15dd9dbe3ac4b76b3e224d54d26483d0dfe6a9ef5a2d3b7137d5259565ffacbd1.14%
d24a4aec99b0ad9263cfc616d35ee2a7845d70f3ab894c8816294bfce7c5b01e1.14%
1baea4a35daab07203753fd875d59e4058c2872a03587bf3ff933546a2ef26a80.85%
466876f453563a272adb5d568670eca98d805e7ecaa5a2e18c92b6d3c947df930.85%
90a0715f0e2b0e4869a83aca689603a437fdb5024ad11c9343160e88d2cd07eb0.85%
458653516caaa16bade2e1aec45c4a11d8cd8ac0aef16f768e766e54c036f90a0.28%

Process Ancestry

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Security Analysis

What does vbc.exe normally do?

Runs from .NET Framework directory. Used during .NET builds to compile VB.NET source files. Part of the build toolchain — rarely invoked directly except on developer machines.

When is vbc.exe suspicious?

Execution on non-developer machines. Compiling source files from temp directories or user profile paths. Spawned by unexpected parents (explorer.exe, WmiPrvSE.exe). Compiled output executed immediately after compilation.

How do attackers abuse vbc.exe?

CODE COMPILATION AND EXECUTION: Attackers drop VB.NET source code and use vbc.exe to compile it into an executable or DLL on the target. This avoids bringing a pre-compiled binary that might be detected by AV. The compiled code can be anything — reverse shell, downloader, credential harvester. Similar to csc.exe (C# compiler) but less commonly monitored.

Detection guidance

MEDIUM-CONFIDENCE: - vbc.exe compiling files from %TEMP%, %APPDATA%, or Downloads - vbc.exe on non-developer systems - vbc.exe followed by execution of the compiled output DATA SOURCES: Process creation (Sysmon 1), file creation (Sysmon 11)

False positive notes

Normal on developer workstations. Build servers compile VB.NET code routinely. msbuild.exe invokes vbc.exe during .NET builds.

MITRE ATT&CK techniques

T1127

References

https://attack.mitre.org/techniques/T1127/

Related Processes

csc.exe devenv.exe InstallUtil.exe MSBuild.exe

Ask Rocky about vbc.exe

Rocky answers questions about vbc.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.