There is 1 piece of malware that is fileless.
https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=761
Runs completely from the Windows Registry