advanced-systemcare-setup.exe

Top Paths

• C:\lab\in

Top Hashes (SHA256)

• 7064471a077ab13dc0ca2e7b31a3504d8c88405839dcf23cbc5e818d065a4f5d

Top Grandparents

• cmd.exe

Top Parents

• powershell.exe

Top Children

• advanced-systemcare-setup.tmp

What does advanced-systemcare-setup.exe normally do?

Advanced SystemCare's setup is an Inno Setup installer used to deploy IObit's PC optimization suite; legitimate use is a user (or software-deployment tooling) launching it interactively or silently once per host. In the lab the package was retrieved via winget (winget.exe show --id IObit.AdvancedSystemCare under cmd.exe) and the installer was run as C:\lab\in\advanced-systemcare-setup.exe /S from powershell.exe; it was validly signed by "IObit Co., Ltd". It unpacked the standard Inno chain — advanced-systemcare-setup.tmp in %LOCALAPPDATA%\Temp\is-*.tmp with an /SL5= argument — which then spawned IObit-signed helpers Installer\LocalLang.exe (with a conhost.exe console) and Installer\Setup.exe /InnoSetup "<original setup path>" from a second is-*.tmp\Installer directory. DNS showed cdn.iobit.com alongside ordinary Windows/Microsoft telemetry, Store, Widgets and WebView2 traffic; no autoruns were captured in this single run, and observed file writes and unsigned DLL loads were background OS/QEMU-guest-agent activity rather than installer artifacts. Expect a post-install footprint of services and scheduled tasks running with SYSTEM rights, kernel/filter drivers, shell extensions, and periodic contact with IObit update/promo endpoints.

When is advanced-systemcare-setup.exe suspicious?

Installer executed with /S (silent) by a non-interactive or remote parent — wmic/WMI, PsExec, a service host, wscript/mshta, a macro-enabled Office process, or a PowerShell one-liner that just downloaded it — especially on servers, domain controllers or many hosts within minutes, which suggests unauthorized mass-deployment rather than user choice. Any copy of advanced-systemcare-setup.exe with an invalid, missing, or non-"IObit Co., Ltd" signature, or with an unexpected size/hash, sourced from a crack/keygen site, torrent, or SEO-poisoned download rather than iobit.com/winget. Deviations from the observed Inno chain: the is-*.tmp helper spawning cmd.exe, powershell.exe, certutil, rundll32, regsvr32, or writing executables outside %TEMP%\is-*.tmp and %ProgramFiles%\IObit; LocalLang.exe or Setup.exe running from a path other than a fresh is-*.tmp\Installer directory, or those filenames appearing without the parent setup process. Post-install red flags: IObit-signed binaries loading DLLs from user-writable directories, IObit kernel drivers being loaded on hosts where the product is not installed, IObit services or scheduled tasks with altered image paths or added command-line arguments, and beacon-like traffic to non-IObit domains from the product directory. Also treat bulk invocation of the suite's privacy/junk-clean features (event-log, prefetch, browser-history, free-space wipe) shortly after other attacker activity as anti-forensic behavior rather than maintenance.

How do attackers abuse advanced-systemcare-setup.exe?

The strongest real-world abuse of this family is supply-chain and lure abuse: in January 2021 IObit's own forum/download infrastructure was compromised to distribute DeroHE ransomware inside what appeared to be legitimately delivered IObit software, and trojanized "Advanced SystemCare Pro crack/keygen" builds are a persistent commodity-malware lure that drop info-stealers (RedLine, Vidar, Lumma), loaders (PrivateLoader/SmokeLoader) and coin miners while the real optimizer installs as cover. Because the installer and its components carry a valid IObit Authenticode signature, attackers reuse the brand for masquerading — renaming droppers to advanced-systemcare-setup.exe or setup.exe, or side-loading malicious DLLs next to IObit-signed EXEs so the malicious code inherits the trusted process identity and any AV path exclusions users create for optimizer suites. The installed product itself is attractive post-compromise: it registers SYSTEM-level services, scheduled tasks and a kernel/mini-filter driver, so an attacker with admin rights can hijack the service binary path or DLL search order for privilege escalation and persistence, and vulnerable IObit-family drivers have been catalogued as BYOVD candidates for terminating EDR/AV processes and gaining kernel primitives. Operationally, the suite's own features are dual-use anti-forensics: Privacy Sweep, Junk File Clean, registry clean and the shredder/free-space wiper delete browser history, prefetch, jump lists, USN/recent-file artifacts and temp payloads, and the "block suspicious process"/startup manager can be used to disable defensive software and legitimate autoruns. Finally, silent (/S) pushes of PUP-class optimizers via compromised RMM, GPO or SCCM channels are used both for adware monetization and to create a plausible-looking installation event that masks other tooling.

Detection guidance

Baseline the legitimate chain — signer "IObit Co., Ltd", parent is explorer.exe/a deployment agent, child is %LOCALAPPDATA%\Temp\is-*.tmp\*.tmp with an /SL5="$..." argument, grandchildren LocalLang.exe and Setup.exe /InnoSetup from is-*.tmp\Installer, and DNS to cdn.iobit.com — then alert on any break in that pattern, particularly script-host or remote-execution parents and /S installs on server/DC roles. Hunt for filename-vs-signature mismatches (advanced-systemcare-setup.exe or setup.exe unsigned, self-signed, or signed by anyone but IObit) and for IObit-named binaries running from Downloads, ProgramData, Public, or user AppData paths outside the transient is-*.tmp directories. Post-install, monitor service creation and scheduled-task registration referencing IObit paths, ImagePath modifications to those services, DLL loads by IObit-signed processes from user-writable directories, and driver-load events (Sysmon Event ID 6 / kernel driver load) for IObit-family drivers on hosts with no corresponding install record, which is the BYOVD signal. Correlate execution of the suite's cleaning/shredder modules with Security log 1102, prefetch/USN deletion bursts and browser-artifact loss to catch anti-forensic use, and treat a first-ever appearance of this software on a managed endpoint that has no software-request ticket as an unauthorized-deployment lead.

MITRE ATT&CK techniques

References

• https://www.iobit.com/advancedsystemcarefree.php
• https://www.iobit.com/