NtCreateThreadEx

Prototype

NTSTATUS NtCreateThreadEx(
  PHANDLE              ThreadHandle,
  ACCESS_MASK          DesiredAccess,
  POBJECT_ATTRIBUTES   ObjectAttributes,
  HANDLE               ProcessHandle,
  PVOID                StartRoutine,
  PVOID                Argument,
  ULONG                CreateFlags,
  SIZE_T               ZeroBits,
  SIZE_T               StackSize,
  SIZE_T               MaximumStackSize,
  PPS_ATTRIBUTE_LIST   AttributeList
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 C2 00 00 00      mov eax, 0xC2     ; win10-22h2 / win11-21h2 differ
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Unlike many of its siblings, `NtCreateThreadEx` has a SSN that *moves on every feature update*: `0xC2` on Win10 21H2/22H2, `0xC6` on Win11 21H2, `0xC7` on 22H2/23H2, `0xC9` on 24H2 and Server 2025. Hardcoding this number is fragile — Hell's Gate or Halo's Gate dynamic resolution is strongly recommended. The function is the kernel-side workhorse behind `CreateRemoteThread`, `CreateRemoteThreadEx` and `CreateThread`; the older `NtCreateThread` is essentially deprecated. Passing a `PS_ATTRIBUTE_LIST` with `PsAttributeIdealProcessor` or `PsAttributeClientId` lets the caller pin the thread or assign it a forged CID.

Common malware usage

The execution step in classic remote injection: after `NtAllocateVirtualMemory` + `NtWriteVirtualMemory` + `NtProtectVirtualMemory`, this syscall is what actually runs the payload in the remote process. Often called with `CREATE_SUSPENDED` so that the implant can install a custom `CONTEXT` (PEB walking, stack spoof) via `NtSetContextThread` before `NtResumeThread`. Variants include using `LoadLibraryA` as `StartRoutine` (oldschool DLL injection), `RtlExitUserThread` decoys, or a JOP/ROP gadget chain that pivots inside the target.

Detection opportunities

Sysmon Event ID 8 (`CreateRemoteThread`) is the headline event — it fires whenever the source and target process differ, with `SourceImage`, `TargetImage`, `StartAddress`, and a stack hash. ETW Threat Intelligence emits `EtwTiLogCreateThread` for remote thread creation and is consumed by major EDRs. `PsSetCreateThreadNotifyRoutine`/`PsSetCreateThreadNotifyRoutineEx` kernel callbacks fire synchronously and cannot be bypassed by userland direct syscalls. A `StartAddress` that does not resolve to a loaded image (i.e. lives in private memory) is the strongest single signal.

Direct syscall examples

; Direct syscall stub for NtCreateThreadEx (SSN 0xC9 on Win11 24H2 / Server 2025).
; WARNING: this SSN moves between feature updates — prefer dynamic resolution.
NtCreateThreadEx PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 0C9h         ; SSN for win11-24h2
    syscall
    ret
NtCreateThreadEx ENDP

// Spawn the thread suspended so we can rewrite RIP / RSP before resuming.
HANDLE  hThread = NULL;
NTSTATUS st = NtCreateThreadEx(&hThread, THREAD_ALL_ACCESS, NULL,
                               hRemote, payload_rva, NULL,
                               THREAD_CREATE_FLAGS_CREATE_SUSPENDED,
                               0, 0, 0, NULL);
if (!NT_SUCCESS(st)) return st;

CONTEXT ctx = { .ContextFlags = CONTEXT_FULL };
NtGetContextThread(hThread, &ctx);
ctx.Rip = (DWORD64)real_entry;        // pivot away from the decoy StartRoutine
NtSetContextThread(hThread, &ctx);
NtResumeThread(hThread, NULL);

// Hardcoding 0xC2/0xC6/0xC7/0xC9 across builds is fragile — resolve at runtime.
typedef NTSTATUS (NTAPI *pNtCreateThreadEx)(
    PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, HANDLE, PVOID, PVOID,
    ULONG, SIZE_T, SIZE_T, SIZE_T, PVOID);

DWORD ssn = GetSyscallNumber(GetProcAddress(GetModuleHandleA("ntdll.dll"),
                                            "NtCreateThreadEx"));
set_ssn(ssn);
indirect_syscall_invoke(/* ... */);

MITRE ATT&CK mappings

• T1055Process Injection
• T1055.002Portable Executable Injection
• T1055.012Process Hollowing
• T1620Reflective Code Loading