Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).
Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).[1][2][3][4][5] For example, the Assembly.Load() method executed by PowerShell may be abused to load raw code into the running process.[6]
Reflective code injection is very similar to Process Injection except that the "injection" loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.[3][4][7][8]
| ID | Name | Description |
|---|---|---|
| C0057 | 3CX Supply Chain Attack |
During the 3CX Supply Chain Attack, AppleJeus leverages the publicly available open-source project DAVESHELL to convert PE-COFF files to position-independent code to reflectively load the payload into memory.[9][10] |
| S1081 | BADHATCH |
BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to |
| S1063 | Brute Ratel C4 |
Brute Ratel C4 has used reflective loading to execute malicious DLLs.[12] |
| S0154 | Cobalt Strike |
Cobalt Strike's |
| S0625 | Cuba | |
| S0695 | Donut |
Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.[15] |
| S0367 | Emotet | |
| G0046 | FIN7 |
FIN7 has loaded a .NET assembly into the currect execution context via |
| S0661 | FoggyWeb |
FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.[18] |
| G0047 | Gamaredon Group |
Gamaredon Group has used an obfuscated PowerShell script that used |
| S0666 | Gelsemium |
Gelsemium can use custom shellcode to map embedded DLLs into memory.[20] |
| S1022 | IceApple |
IceApple can use reflective code loading to load .NET assemblies into |
| G0094 | Kimsuky |
Kimsuky has used the Invoke-Mimikatz PowerShell script to reflectively load a Mimikatz credential stealing DLL into memory.[22] Kimsuky has also used reflective loading through .NET assembly using |
| G0032 | Lazarus Group |
Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.[24][25] |
| S0681 | Lizar |
Lizar has used the Reflective DLL injection module from Github to inject itself into a process’s memory.[26] |
| S0447 | Lokibot |
Lokibot has reflectively loaded the decoded DLL into memory.[27] |
| S1213 | Lumma Stealer |
Lumma Stealer has used reflective loading techniques to load content into memory during execution.[28][29] |
| S1143 | LunarLoader |
LunarLoader can use reflective loading to decrypt and run malicious executables in a new thread.[30] |
| S1059 | metaMain |
metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.[31] |
| S1145 | Pikabot |
Pikabot reflectively loads stored, previously encrypted components of the PE file into memory of the currently executing process to avoid writing content to disk on the executing machine.[32] |
| S0013 | PlugX |
PlugX has loaded its payload into memory.[33][34][35][36][37] |
| S0194 | PowerSploit |
PowerSploit reflectively loads a Windows PE file into a process.[38][39] |
| S1085 | Sardonic |
Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.[40][41] |
| C0058 | SharePoint ToolShell Exploitation |
During SharePoint ToolShell Exploitation, threat actors reflectively loaded payloads using |
| S0692 | SILENTTRINITY |
SILENTTRINITY can run a .NET executable within the memory of a sacrificial process by loading the CLR.[47] |
| S0595 | ThiefQuest |
ThiefQuest uses various API functions such as |
| S0022 | Uroburos |
Uroburos has the ability to load new modules directly into memory using its |
| S0689 | WhisperGate |
WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.[50] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0300 | Detection Strategy for Reflective Code Loading | AN0838 |
Detect anomalous chains of memory allocation and execution inside the same process (e.g., VirtualAlloc → memcpy → VirtualProtect → CreateThread). Unlike process injection, reflective code loading does not perform cross-process memory writes — the suspicious activity occurs entirely within the process’s own PID context. |
| AN0839 |
Monitor for in-process mmap + mprotect + execve/execveat activity where memory permissions are changed from writable to executable inside the same process without a corresponding ELF on disk. |
||
| AN0840 |
Suspicious calls to dlopen(), dlsym(), or mmap with RWX flags in processes that do not typically perform dynamic module loading. Monitor anonymous memory regions executed by user processes. |