Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).
Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).[1][2][3][4][5] For example, the Assembly.Load() method executed by PowerShell may be abused to load raw code into the running process.[6]
Reflective code injection is very similar to Process Injection except that the "injection" loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.[3][4][7][8]
| ID | Name | Description |
|---|---|---|
| S1081 | BADHATCH |
BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to |
| S1063 | Brute Ratel C4 |
Brute Ratel C4 has used reflective loading to execute malicious DLLs.[10] |
| S0154 | Cobalt Strike |
Cobalt Strike's |
| S0625 | Cuba | |
| S0695 | Donut |
Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.[13] |
| S0367 | Emotet | |
| S0661 | FoggyWeb |
FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.[15] |
| S0666 | Gelsemium |
Gelsemium can use custom shellcode to map embedded DLLs into memory.[16] |
| S1022 | IceApple |
IceApple can use reflective code loading to load .NET assemblies into |
| G0032 | Lazarus Group |
Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.[18][19] |
| S0447 | Lokibot |
Lokibot has reflectively loaded the decoded DLL into memory.[20] |
| S1059 | metaMain |
metaMain has reflectively loaded a DLL to read, decrypt, and load an orchestrator file.[21] |
| S0194 | PowerSploit |
PowerSploit reflectively loads a Windows PE file into a process.[22][23] |
| S1085 | Sardonic |
Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.[24][25] |
| S0595 | ThiefQuest |
ThiefQuest uses various API functions such as |
| S0022 | Uroburos |
Uroburos has the ability to load new modules directly into memory using its |
| S0689 | WhisperGate |
WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.[28] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0011 | Module | Module Load |
Monitor for artifacts of abnormal process execution. For example, a common signature related to reflective code loading on Windows is mechanisms related to the .NET Common Language Runtime (CLR) -- such as mscor.dll, mscoree.dll, and clr.dll -- loading into abnormal processes (such as notepad.exe) |
| DS0009 | Process | OS API Execution |
Monitor for code artifacts associated with reflectively loading code, such as the abuse of .NET functions such as |
| DS0012 | Script | Script Execution |
Similarly, AMSI / ETW traces can be used to identify signs of arbitrary code execution from within the memory of potentially compromised processes.[29][1] |