NtCreateTimer

Prototype

NTSTATUS NtCreateTimer(
  PHANDLE            TimerHandle,
  ACCESS_MASK        DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  TIMER_TYPE         TimerType
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 CB 00 00 00      mov eax, 0xCB
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Allocates an executive `KTIMER` object via `ExCreateTimer` / `ObCreateObject`. The object is *unarmed* at creation — it does nothing until `NtSetTimer` provides a due time and optional APC routine. SSN drifts across builds (`0xB4` on 1507 → `0xCB` on Win11 24H2 / Server 2025), so direct-syscall implementations must resolve dynamically. `NotificationTimer` keeps the dispatcher object signaled after expiry (all waiters released and stay through), while `SynchronizationTimer` auto-resets after releasing one waiter — the latter is what sleep-mask designs use.

Common malware usage

The first half of the **Ekko sleep-mask engine** (Austin Hudson, 2022) — and the design copied wholesale by Foliage, Cronos, Zilean and most modern fork-derived crypter loaders. A timer is created, then `NtSetTimer` arms it with `TimerApcRoutine = RtlCaptureContext`/`SetEvent`/`VirtualProtect` chain stages, and the implant performs an alertable wait. Each timer expiry queues an APC, the APC runs a ROP-stage that re-encrypts the implant memory and re-arms — producing a beacon whose code is RWX → RW → encrypted on every cycle, defeating naive memory scanners. NtCreateTimer alone is benign; the *triad* (timer + event + alertable wait inside private memory) is the IOC.

Detection opportunities

No dedicated Sysmon event for timer creation. ETW `Microsoft-Windows-Kernel-Object` with the `Timer` keyword exposes object creation; correlating timer handles held by a thread whose RIP at the moment of `NtSetTimer` lies in unbacked / RWX memory is the high-fidelity signal. Most EDRs that defeat Ekko do it by scanning the suspended thread's stack and walking back through KiUserApcDispatcher frames at the moment a special user APC delivers — they catch the encryption stage in flight rather than the timer creation itself.

Direct syscall examples

; Direct syscall stub for NtCreateTimer (SSN 0xCB on Win11 24H2 / Server 2025)
NtCreateTimer PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 0CBh         ; SSN — drifts; resolve dynamically for portability
    syscall
    ret
NtCreateTimer ENDP

// Step 1 of the sleep-mask triad: a synchronization timer the APC chain will arm.
HANDLE             hTimer = NULL;
OBJECT_ATTRIBUTES  oa     = { sizeof(oa), 0 };
NTSTATUS st = NtCreateTimer(&hTimer,
                            TIMER_ALL_ACCESS,
                            &oa,
                            SynchronizationTimer);
if (!NT_SUCCESS(st)) return st;
// hTimer will be armed by NtSetTimer with TimerApcRoutine pointing at the ROP gadgets.

// Cargo: windows-sys = "0.59" (Win32_System_Threading)
use windows_sys::Win32::System::Threading::CreateWaitableTimerW;
use std::ptr::null;

unsafe fn make_timer() -> *mut core::ffi::c_void {
    // bManualReset = 0 → SynchronizationTimer kernel-side.
    CreateWaitableTimerW(null(), 0, null())
}

MITRE ATT&CK mappings

• T1027.011Fileless Storagemitre ↗
• T1106Native APImitre ↗
• T1029Scheduled Transfermitre ↗