There is 1 piece of malware that is fileless.

https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=761

Runs completely from the Windows Registry