Overview

overview

10

Static

static

3

Lag.Switch.exe

windows10-2004-x64

10

Lag.Switch.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    32s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 16:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Lag.Switch.exe
  • Size 32.4MB
  • Sample260629-tsbqlsbs2j
  • SHA256 56a4a719fba32b388e8447e390ad63e0fc9bfd8330f4555707a90327b7f9dfb0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
blankgrabberstealer

Malware Config

Signatures

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Loads dropped DLL 32 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lag.Switch.exe
    "C:\Users\Admin\AppData\Local\Temp\Lag.Switch.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6004
    • C:\Users\Admin\AppData\Local\Temp\Lag.Switch.exe
      C:\Users\Admin\AppData\Local\Temp\Lag.Switch.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2632

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\QtGui.pyd
        • Size 2.4MB
        • SHA256 a9408e3b15ff3030f0e9acb3429000d253d3bb7206f750091a7130325f6d0d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\QtWidgets.pyd
        • Size 4.9MB
        • SHA256 a1e97a2ab434c6ae5e56491c60172e59cdcce42960734e8bdf5d851b79361071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qminimal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\qt-plugins\platforms\qminimal.dll
        • Size 824KB
        • SHA256 05d1e7364dd2a672df3ca44dd6fd85bed3d3dc239dcfe29bfb464f10b4daa628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qoffscreen.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\qt-plugins\platforms\qoffscreen.dll
        • Size 736KB
        • SHA256 54097626faae718a4bc8e436c85b4ded8f8fb7051b2b9563a29aee4ed5c32b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwebgl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\qt-plugins\platforms\qwebgl.dll
        • Size 470KB
        • SHA256 9c3b2fa2383eeed92bb5810bdcf893ae30fa654a30b453ab2e49a95e1ccf1631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\qt-plugins\platforms\qwindows.dll
        • Size 1.4MB
        • SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qxdgdesktopportal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll
        • Size 66KB
        • SHA256 e23fbc1bec6ceedfa9fd305606a460d9cac5d43a66d19c0de36e27632fddd952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindowsvistastyle.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll
        • Size 140KB
        • SHA256 d9b21182952682fe7ba63af1df24e23ace592c35b3f31eceef9f0eabeb5881b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt5Core.dll
        • Size 5.7MB
        • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt5Gui.dll
        • Size 6.7MB
        • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt5Widgets.dll
        • Size 5.2MB
        • SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icon.ico
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\icons\icon.ico
        • Size 4KB
        • SHA256 1e84dba37b9b2b6c2774832d6f5827fe8b31e0c3aba1b6cbc60f54edb6c5ae6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\psutil\_psutil_windows.pyd
        • Size 65KB
        • SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes311.dll
        • Size 134KB
        • SHA256 6583c15de0f5a1b20c8750b0599e5cf162f91f239f8341bda842485d8bbc9887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\PyQt5\QtCore.pyd
        • Size 2.4MB
        • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\PyQt5\sip.pyd
        • Size 120KB
        • SHA256 406953b36fb04046c8d476d85a33a8829bb62e37804b08f0cf36f6c5529a904c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\main.dll
        • Size 41.3MB
        • SHA256 c78263e7ff5f53fc412db1881d76a008266d1ac94465adefc07603abe668850c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\msvcp140.dll
        • Size 540KB
        • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\msvcp140_1.dll
        • Size 34KB
        • SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\python3.dll
        • Size 64KB
        • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\vcruntime140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32gui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\win32gui.pyd
        • Size 237KB
        • SHA256 d720e0b83caf8f3ef9cc4af5677e2d5f376b558aeedf3dc2d0c06557ba666a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32process.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\win32process.pyd
        • Size 55KB
        • SHA256 a77d41f5ede945749e55aee49adb35f6794f8fe376a162a65b57d1368f051f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winsound.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6004_134272235418926816\winsound.pyd
        • Size 28KB
        • SHA256 53e8eb4605d728e811a0239ed3fe0905df212a6c554da26bcfbe096980fde1d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2632-131-0x00007FFBC33D0000-0x00007FFBC3633000-memory.dmp
        Download

        memory/2632-126-0x00007FFBC3D00000-0x00007FFBC4241000-memory.dmp
        Download

        memory/2632-125-0x00007FFBC4A40000-0x00007FFBC4F2C000-memory.dmp
        Download