Here is an overview of the initialization process.
First,
the stager is executed, which will trigger an HTTP connection to the handler.
The handler then reads a fresh copy of the payload,
also known as metsrv.dll, and patches a small stub of
shell code into its DOS header.
It then sends the payload back to the stager in response to the HTTP request.
Finally,
the stager reads the response into memory and executes it. Since
the DOS header now contains the shell code stub,
which calls the Reflective DLL injection library, the
payload is loaded reflectively. And finally,
the DLL main function is called,
which completes the initialization. At this point, a couple of extensions,
such as stdapi, are also sent over by the handler and reflectively loaded
to provide many of the standard commands.