Procedure examples

Pikabot reflectively loads stored, previously encrypted components of the PE file into memory of the currently executing process to avoid writing content to disk on the executing machine.

Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.

Emotet has reflectively loaded payloads into memory.

BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to `CreateThread`.

SystemBC has downloaded a text file into memory and set the area of memory via the VirtualProtect call. Then, SystemBC has executed the file via the CreateThread call.

WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.

LunarLoader can use reflective loading to decrypt and run malicious executables in a new thread.

PlugX has loaded its payload into memory.

Lumma Stealer has used reflective loading techniques to load content into memory during execution.

Cuba loaded the payload into memory using PowerShell.

ThiefQuest uses various API functions such as NSCreateObjectFileImageFromMemory to load and link in-memory payloads.

FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.

MuddyViper has reflectively loaded the decrypted HackBrowserData tool in a new thread.

Fooder has reflectively loaded a payload into memory.

Uroburos has the ability to load new modules directly into memory using its `Load Modules Mem` command.

Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process by loading the CLR.

Lokibot has reflectively loaded the decoded DLL into memory.

IceApple can use reflective code loading to load .NET assemblies into `MSExchangeOWAAppPool` on targeted Exchange servers.

metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.

BRUSHFIRE has executed its commands within memory and is not saved on disk.

Gelsemium can use custom shellcode to map embedded DLLs into memory.

Lizar has used the Reflective DLL injection module from Github to inject itself into a process’s memory.

SILENTTRINITY can run a .NET executable within the memory of a sacrificial process by loading the CLR.

PowerSploit reflectively loads a Windows PE file into a process.

Brute Ratel C4 has used reflective loading to execute malicious DLLs.

Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.