# Shellcode execution via Windows thread-pool wait callbacks (CreateThreadpoolWait) - public technique write-up

> A public blog post by cocomelonc (2026-10-07), archived in the Malpedia library, demonstrates running shellcode by registering it as the callback of a Windows thread-pool wait object (CreateThreadpoolWait/SetThreadpoolWait) and triggering it with SetEvent. The article names no malware family, actor, CVE or in-the-wild use; it is an educational PoC.

- **Published:** 2026-10-26T15:15:46Z
- **Last reviewed:** 2026-10-26T15:15:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4458
- **ID:** TL-2026-4458
- **Severity:** LOW
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The write-up 'Malware development trick 67' shows how shellcode can be dispatched through the Windows thread-pool wait API instead of CreateThread or similar direct execution primitives. The flow is: create trigger and completion events with CreateEventW; register a callback address and context pointer with CreateThreadpoolWait; associate the wait object with the trigger event via SetThreadpoolWait; then call SetEvent so a thread-pool worker thread invokes the callback. SetEventWhenCallbackReturns, WaitForThreadpoolWaitCallbacks and CloseThreadpoolWait are used for completion and cleanup.

Two examples are published. Example 1 (hack.c) allocates memory with VirtualAlloc, copies in a 73-byte returning x64 wait-callback payload assembled from meow.asm with NASM, changes protection to PAGE_EXECUTE_READ, flushes the instruction cache and registers the buffer address as the thread-pool callback. The payload shows a MessageBox ('Meow-meow!', caption '=^..^=') and must return to the thread pool rather than terminate the process; it receives API addresses and the completion event handle through the context pointer (RDX). Example 2 (hack2.c) implements the callback as a normal compiled C function (meow_callback) to show the same dispatch mechanism without handwritten assembly. Binaries were built with x86_64-w64-mingw32-gcc and tested on a Windows x64 lab; the author reports an ANY.RUN sandbox run with no threats detected.

No in-the-wild exploitation, CVE, actor, malware family or network infrastructure is reported. The author notes that thread-pool callbacks are ordinary Windows functionality used by many legitimate programs, so analysis should focus on the callback address (for example a dynamically allocated executable region rather than a module code section), the context data, and the triggering event. Because no network IOCs exist, no BeaconBeagle correlation was applicable.

## MITRE ATT&CK

- T1106 Native API
- T1055 Process Injection
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1587.001 Malware

## Sources

- [Malware development trick 67: Run shellcode via CreateThreadpoolWait. C and assembly examples](https://cocomelonc.github.io/malware/2026/10/07/malware-tricks-67.html)
- [Malpedia library entry for the cocomelonc article](https://malpedia.caad.fkie.fraunhofer.de/library/c1afa1a7-7d0d-4843-8448-6e3b078fda74/)
- [cocomelonc/meow - 2026-10-07-malware-tricks-67 example code](https://github.com/cocomelonc/meow/tree/master/2026-10-07-malware-tricks-67)
- [Microsoft Learn: CreateThreadpoolWait function (threadpoolapiset.h)](https://learn.microsoft.com/en-us/windows/win32/api/threadpoolapiset/nf-threadpoolapiset-createthreadpoolwait)
- [MITRE ATT&CK T1055 Process Injection](https://attack.mitre.org/techniques/T1055/)
- [MITRE ATT&CK T1106 Native API](https://attack.mitre.org/techniques/T1106/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4458