InstallUtil.exe

Top Paths

• C:\Windows\Microsoft.NET\Framework64\v4.0.3031974.15%
• C:\Windows\Microsoft.NET\Framework\v4.0.3031922.66%
• C:\Windows\Microsoft.NET\Framework64\v2.0.507272.45%
• C:\Windows\Microsoft.NET\Framework\v2.0.507270.74%

Top Hashes (SHA256)

• 9634e12b5e2bfa4b1c5b35d227ff434d9ff405f845a862068e0f11c1369b7a6120.75%
• 774adcef9cebc4b12c2c10d0a05ed3d4f59f739db38700e4a763085b8146137e14.41%
• c664ccad43243a25de22e85485560fa084bf40e785d86b8391ce4107d47cd99f10.65%
• 54b7f4ab6dd3a1f4d5791af8ada4f1c2e3e102d8fa76808e299fcefe2478f0a89.68%
• 756e583ff1e00a5db0a2bee3849693920c4bdfbe87d8757834093372cd690c717.63%
• 6956094d3bb4de18a8b43237bbe05d2b8fb669e5595079e6ee9fe783bd4db8af7.1%
• 34f7c61e2ec24a53ce978e42e6941989f78d13eceaca1ab10d24c3a18a695e515.81%
• 4379c7249cf01fdd1f87e304a94c1137c1d0af8c56195ac77def0f7726bf2dd55.05%
• d0f224023900420d0e541360144bfbfb03cbb936391ce6d3e98590ddca51bc6a4.62%
• b6febe5bfe848fefd52e906f930b829a67456057836651d57fee955d21c069162.04%

Top Grandparents

• msiexec.exe58.56%
• unins000.exe6.13%
• services.exe3.96%
• cmd.exe0.9%
• explorer.exe0.72%
• Tvsukernel.exe0.72%

Top Parents

• msiexec.exe70.21%
• Uninstall.exe4.47%
• CylanceSvc.exe2.13%
• setup.exe1.06%
• cmd.exe0.64%
• python.exe0.53%
• LTSVC.exe0.21%

Top Children

• conhost.exe49.57%
• mofcomp.exe49.05%
• lodctr.exe0.69%
• unlodctr.exe0.69%

What does InstallUtil.exe normally do?

Runs from .NET Framework directory (C:\Windows\Microsoft.NET\Framework[64]\vX.X.XXXXX\). Used during software installation to register .NET assemblies and run custom install actions. Short-lived, exits after processing. Uncommon in most environments outside of developer workstations and build servers.

When is InstallUtil.exe suspicious?

Execution outside of software deployment context. Loading assemblies from temp directories, user profile paths, or network shares. Spawning cmd.exe, powershell.exe, or making network connections. Running with /LogFile= /LogToConsole=false (suppresses output). Assembly loaded from a non-standard path.

How do attackers abuse InstallUtil.exe?

installutil.exe is a LOLBin that executes code in .NET assemblies through the Installer class interface. 1. CUSTOM INSTALLER CLASS EXECUTION: Attackers compile a .NET assembly with a class inheriting from System.Configuration.Install.Installer. The Install(), Uninstall(), or BeforeInstall() methods contain malicious code (reverse shell, downloader, etc.). Running "installutil.exe /LogFile= /LogToConsole=false malicious.dll" executes the code without leaving obvious logs. 2. APPLICATION WHITELISTING BYPASS: installutil.exe is a signed Microsoft binary in the .NET Framework directory. Default AppLocker/WDAC policies allow it, letting attackers execute arbitrary .NET code that would otherwise be blocked. 3. CONSTRAINED LANGUAGE MODE BYPASS: In PowerShell Constrained Language Mode environments, installutil can execute full .NET code outside PowerShell's restrictions. Used by APT groups including APT41, FIN7, and various commodity malware. Common in red team toolkits.

Detection guidance

HIGH-CONFIDENCE DETECTIONS: - installutil.exe loading assemblies from %TEMP%, %APPDATA%, Downloads, or network paths - installutil.exe with /LogFile= /LogToConsole=false (output suppression) - installutil.exe spawning cmd.exe, powershell.exe, or making network connections - installutil.exe run by non-developer/non-admin users MEDIUM-CONFIDENCE: - Any installutil.exe execution in environments without .NET development (baseline to zero) DATA SOURCES: Process creation (Sysmon 1, Windows 4688), .NET assembly load events, module load (Sysmon 7)

False positive notes

Legitimate during .NET application installation (MSI packages calling installutil for assembly registration). Software deployment tools (SCCM, PDQ Deploy) may invoke it. Developer workstations during build/test cycles.

MITRE ATT&CK techniques

References

• https://lolbas-project.github.io/lolbas/Binaries/Installutil/
• https://attack.mitre.org/techniques/T1218/004/