home

icreinstall_c.exe

Lotacepab

Darwen Marketing Inc.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_c.exe, “Lotacepab Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.stocktowersoftware.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Falusose   (signed by Darwen Marketing Inc.)

Product:
Lotacepab

Description:
Lotacepab Setup

Version:
3.8.4.4

MD5:
983ea35685c10eabf5c5f409f6ab5e68

SHA-1:
4ef36d285861144ddec89720fdca36f544b5d1d7

SHA-256:
69a81a89047e1f7b32b363a0d3f63e8aa0d10ea73187c0a61e50d848b10b69a2

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/30/2024 2:06:22 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DarwenMa.Installer (M)
16.3.22.8

File size:
1014.8 KB (1,039,128 bytes)

Product version:
3.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_c.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
thawte, Inc.

Valid from:
2/16/2016 5:30:00 AM

Valid to:
5/18/2017 5:29:59 AM

Subject:
CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1F1F22B813CDB509DAAD9139C753C40F

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:k1UD+IEILGTewEIKzX68O/ad5gF2SYq/6QgsyQE3Jt7tU8LwIbYwe:ke6IEIqCnzK8sUCF2hsyb3JhtXbf

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9078

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_c.exe has been seen being distributed by the following 16 URLs.

http://www.stocktowersoftware.com/c?x=Na8WEQ9Z0udj5Ge61v1XJrUcAX3OnQ YTns7Jj uzOI=&c=G4dSiXDVasX67497uD9B4iKa/EYlYAe/wimK cOQp1ys/5HgIM8wKkHtLAB ychAzoEGXOArdO2lYIkdD J9jlwLuvcVFIr2BGAn1vtB6vsObHCkywB/qWswB6QPDoz9&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=goghn4e/xSW OAwYRUUioepzxmvCmb Gg3aXWsP5CME=&c=wJkEeA/rNjYcrEP9NezvwVVxY3HNtCglJLseRahcCGFbo IvPkhk9KykPtXrv1B0dpQkLKI3KCQewNZyPfYF8SbjTLZCFIruifqgIkJycOQElXKECjUVPSczgq4rQVZA&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.bytehostbulk.com/c?x=vxUrYeTcOQMcgO 4AmgyRwMv5KfeN lFGkEu9pPHgzs=&c=/sPPOYLMDmaeJjXrPNSUh/KiKuUuzPpD9qVzz5ZnwtTsAe2twTHuWQkIkgt8/nmbWZ8dstPyovx3dxJI QYPinEtCkjJ/GjYPcj8aN7FYz0d7ILw 1g0fYHS1wDhoT0M&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.bytehostbulk.com/c?x=m6UDNt8FA4TZY X UxjrRXrleURFcVlj3A/wsVgKlcM=&c=ksl8B9Vb8VLXi5qvrtT2VHOQRM42vxY1ppT2BemKLmT9rbblN0tdcryWVIOMaGfaZYu20QqXXlB2iRZt2e1WwRRaKN/FzRDELYVJxDj/AZE7wc4jG3CyJGRlKr9DuU5c&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.stocktowersoftware.com/c?x=K L4FQfg b3HDr8HbEAb4vogYuQcZBLsjaMQyC9pLmI=&c=q8KRbLRCbmPzPnGkdR5M02Ivosi0wNX Up yDSqcYhT sYlKaM2jbS/jNCpht1lZLxuLVwHVriykRDN2GzydvtG6UXXNm1iVAUWSF1PbZKm0Qz4QZ9y1aCshkNbqkkxW&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.bundlessignstag.com/c?x=ZnhNLN841V1EKv6l6t 4wSBhFlsNogs2r0ySrS0Dh5I=&c=rPMn3otX4WT0vg50gM6/ycKKwCF0lbk/P5GWGU6M 2yYesDhsBvxRxs3wZFcD4lMlcF5Tud1IUdhcC3ERntm22SCcbTqFlQKzASCRgBoKDpwPQ8TSQjhMajcMMrzAinl&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=KBE0asVbxVIDpvoBeGFUe0olfVFJoBrNRRBVeAcyRf8=&c=eTcrhJxvFAANOfslbNzepctFhyRRII7w3/Kw FejttsDxCHEMSm/nU4mp5Sv7QaoNdBsYIi7aFPqIgL74 QNP 7vm8r MHbcwuk7Q0k4d80HGI vXmBTtbmIUAGaCzLo&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=1s9Zf QlYWl8o7lKdk4tJzFIibnEmBquXXZwv6z8moM=&c=KfWUsHEUB8lR4DGcuvIZVrxaSGdMOZBW77f8VzFLfxc1pCCTwaYkgzRL35pMpS wHUTfSCDGjD8BJ0RwVmp J /531GxNFiTuO2V8JTzLDF GfHqhMCyXz0m/mqsvd5w&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=OI4XMwGHJ/PKTtO12GiLbOAcm BQHLzdAMAlK1eGqGo=&c=hogcRKcjaLF GiJZ4NUuFrcCgnEAq9HF198q20xEE OLBOKpJ aUzho/H/QBaFno 0LI/fk0VIqn92G0p8MBmUcoAyv8Q/PXLwXeBAn 4HR7CSRL/TNMk6SDR9rlIwBQ&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.stocktowersoftware.com/c?x=lFeqEi/q6qHQcOsGBJp1 8hLkkhJ/xlRl9rl84xFs2w=&c=t7VAdvCIqE7jpoIOQzVRh5p urlWWX41pZmWmsgk0jnqMSuV7v84YEC 6Nb/ASI/knAMLim5tUlBjIGXc /IMRSNCtIAlLa9vLS3KfwSlVfUT4ug73CchFuXwwZDv6dW&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.bundlessignstag.com/c?x=5r8qxTwAy5zKPMaUoQ953AMdqIImAaH4mNWnMvDUB0M=&c=O LUOUaU9lflBOJ4W7UsbFhIGZFRIMyOsF1EnSDdB1WJ0rrcUt/nQeDhJz9pLixEWSftEK3BnnXypareH6GM0xdms79k39svdU740Q5xaUlpTgqMRqpVOnWO6H0hzLl1&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.stocktowersoftware.com/c?x=ZQ7THp/ vSRHFXGtYs/FctaQx7YCZhLcWNKfrofZd4=&c=FCE0kVgdHVKJAD1OZ5eNqCFeX0vlxl7 j/rqry eWDq7b2 Xap l7f9lohmuKRnzhfi/8ITKboMdgK/OI4jfOn1MCuqZnNiOS14MAU3n81683ekLgLFPwlu6DSqB9PiB&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.todayuniversebits.com/c?x=b8zg23pjvoRAulLqgaQezbHKVVWz1kJEN0TTgZY4BhQ=&c=k6So5PNNhRQjqbJ3iNfzE2IYd4dwU2j A1F9AOxIwiU99K4qCRujNsNzRvEMVxTVUK6/GVgOe kAVOx/qOOfupcDkWbpQPaFyi438F99hSPjuHi8wCiR/vlPftnQBsM2&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.stocktowersoftware.com/c?x=lEgOZeveHpFBS86erOXffPZZMzh73ktTrLJkIveLIpc=&c=JXvfZbBLesiMcuJ1MeoIqZlcc7U1r7OmZEHpdxbLHb994dN07M3xIJ RJpS8JrdBvFro01MUboit7Xpbqy8gO3fSJ0FYiv12K12PLGAP2LvPiw8Pi 66UKlK6VxRCBHS&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.bundlessignstag.com/c?x=Tja3vGNYcwMQJ8HADCcfalO0qIKHD W6N73C6Hy79QM=&c=8Tyo9w 4Bhx1SfvTtnQclTFjDGek5CzHgHE7B2KDibApzCtTYlsIz3Gmf0IdXUd/2y IAXYBewiJsNBtk5JO1b67mTYl1 tK1ZVayPsbuhKKeZZ71FTo0YSnVvcIZoFM&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

http://www.hostgifthead.com/c?x=G4Qrf4Lao0CNCppBfcWpTLI9ES6Ki aQhefu42p fuE=&c=C BEZnE 6m2t87mbSOIg9jeJbBpNkJqp2F A23xTbR3H JqNM2NMN3Ay QnZ5C fOV7HylunzSmWAMdgoUo3K4EHKUAKQvE25mgaeNlXovkSInpEJn6L2ZuoEVMXdE9v&downloadAs=Google Chrome Setup.exe&fallback_url=http://www.downloadfree4.com/.../index.php

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.