Ingext
Incident Investigation
A PUP bundler already confirmed on this tenant dropped a pre-blocklisted payload
SentinelOne raised two malicious-confidence detections on DESKTOP-K7M2Q9 — PCAppStore.exe (publisher FAST CORPORATION LTD) and a second-stage DLLWrapper.exe it dropped. Ingext AI escalated on three grounds; all three resolve, but one operational gap remains open: DLLWrapper.exe's quarantine failed because the agent could not find the file, and the live agent record still reports 1 active threat as of this review.
Confirmed malicious: PC App Store, the same Fast Corporation LTD product a Globex analyst already marked true_positive on another host a month ago, ran from an autostart entry on DESKTOP-K7M2Q9 and dropped a payload SentinelOne's cloud had pre-blocklisted six days earlier. The parent was fully remediated; verify on the endpoint that the dropped file is actually gone and resolve the stale active-threat flag.
Case record
| Subject | DESKTOP-K7M2Q9 (asset) |
| Tenant | Globex |
| Window | 2026-09-26 → 2026-10-26 |
| Incident time | 2026-10-26 10:10:49Z |
| Peak riskScore | 52000 (Ingext_SentinelOne_NewActiveThreat / all 5 rules combined) |
| Rules | Ingext_SentinelOne_NewActiveThreat, SentinelOne:EDR_PCAppStore.exe_-_Padded_Certificate_detected, SentinelOne:EDR_DLLWrapper.exe_detected_as_Malware, Ingext_SentinelOne_ProcessKilled, Ingext_SentinelOne_QuarantinePerformed |
| AI-assist verdict | Escalate to Tier 2 (both tier-one workflows), citing DLLWrapper.exe's failed quarantine, an "infected vs not-infected" profile conflict, and IP 198.51.100.200 as an IOC |
Three grounds for escalation, tested
Quoted from the AI-Assistant's comments on the ticket (createdOn 2026-10-26T10:17:04Z and 10:22:14Z).
1“"DLLWrapper.exe remains UNMITIGATED (possible disk residue)" / "quarantine failed for DLLWrapper.exe"”
Confirmed in the raw SentinelOneThreat record: the quarantine action returned status: failed, actionsCounters: {success:0, notFound:1, total:1} — the agent could not find the file on disk when it tried. kill succeeded (the running process was terminated). This is consistent with the file having already been removed (by the parent's own cleanup, or by the file deleting itself) rather than a quarantine malfunction, but it is not proven — see gap below.
2“"Data conflicts remain (earlier 1 active threat vs later profile showing 0; agent inactive since 2026-10-23)"”
Resolved: the isActive:false / lastActiveDate: 2026-10-23 reading came from the sentinelOneAgent snapshot table, timestamped 2026-10-26T01:57:56Z — taken before this incident. The live agent record, read in this review via investigate_sentinelone_alert and independently confirmed in the raw SentinelOneThreat documents, shows isActive: true, infected: true, activeThreats: 1, lastActiveDate: 2026-10-26T10:34:38Z — the agent reconnected and is live now. Not a data conflict; a stale snapshot read before reconnection.
3“"an external IP (198.51.100.200) was observed" / "Block... egress to 198.51.100.200"”
198.51.100.200 is DESKTOP-K7M2Q9's own externalIp, as SentinelOne's management console records it (identical value in the live endpoint record's externalIp field and in every activity on this agent, including the benign "Live Updates for Static AI were merged" activity at 10:16:26Z). It is the host's own NAT/public address, not a C2 destination; there is nothing to block.
DLLWrapper.exe was dropped by PCAppStore.exe, not the reverse
Summary buckets read 10:10:00 / 10:11:00. Times below are the raw SentinelOne activity and threat timestamps.
| Time (UTC) | Actor | Event |
|---|---|---|
| 10:10:49.811 | SentinelOne EDR (SentinelOne Cloud engine) | DLLWrapper.exe (...\PCAppStore\download\DLLWrapper.exe) identified malicious — cloud hash verdict already "black" (pre-blocklisted); originatorProcess: PCAppStore.exe |
| 10:10:50.068–.111 | Agent | DLLWrapper.exe process killed (success) |
| 10:10:52.496 | Agent | DLLWrapper.exe quarantine failed — file not found (notFound:1) |
| 10:10:55.134 | SentinelOne EDR (Reputation engine) | PCAppStore.exe (...\PCAppStore\PCAppStore.exe) identified malicious, launched /src=autostart by explorer.exe as DESKTOP-K7M2Q9\Owner |
| 10:10:56.627 | Agent | PCAppStore.exe process killed (32/32 kill actions succeeded) |
| 10:11:00.240 | Agent | PCAppStore.exe quarantined (3/3 success) |
| 10:11:00.621 | Agent | PCAppStore.exe fully remediated (788/788 actions succeeded, no pending reboot, no failed rollback) |
| 10:16:26.062 | Agent | Routine Static AI live-update merge (unrelated to the detections; carries the same externalIp 198.51.100.200 seen on every activity) |
This is isolated — no other host fired any of these rules in the last 7 days
One behavior_summary_search per rule, Globex only, last 7 days, excluding this ticket.
Base rate within Globex, per rule, last 7 days
| Rule | Other entities | Reading |
|---|---|---|
| Ingext_SentinelOne_NewActiveThreat | 0 | No other host |
| SentinelOne:EDR_PCAppStore.exe_-_Padded_Certificate_detected | 0 | No other host |
| SentinelOne:EDR_DLLWrapper.exe_detected_as_Malware | 0 | No other host |
| Ingext_SentinelOne_ProcessKilled | 0 | No other host |
| Ingext_SentinelOne_QuarantinePerformed | 0 | No other host |
What did not happen
Each negative below was run against a control proving the query finds these operations elsewhere on the tenant — a zero from a broken query looks identical to a real one.
- No other detection on this agent, ever. Agent-wide
lake_searchon the agent uuid/id over 30 days returns 52 documents total, all of them this incident's own threats, activities and alerts, plus routine join/scan/live-update activity from the agent's registration on 2026-10-16. Control: the same search mechanism finds a separate, earlier true_positive detection of the same product on another Globex host (SALES-LPT-03, 2026-09-30), so the zero here is real, not a broken query. - No spread of either hash to another host. SHA-1 census for both PCAppStore.exe (
e28c4f01...) and DLLWrapper.exe (7a91d3c6...) in theSentinelOneindex, 30 days, returns only DESKTOP-K7M2Q9. Control: the same query shape on the product's earlier, different-build hash (0f5b9e17...) correctly returns SALES-LPT-03. - No network corroboration — this host is not visible to the monitored firewall. FortiGate
NetworkFortigateTrafficover the incident window (2026-10-25T10:10Z–2026-10-27T10:10Z) returns 0 rows for this host's address (192.168.50.104) and for its externalIp (198.51.100.200), against a 329,980-row scan. Control: the same table shows live traffic for other internal subnets (192.168.1.x, 192.168.2.x, 192.168.24.x) in the same window, so FortiGate logging itself is working — DESKTOP-K7M2Q9's subnet simply is not behind this monitored firewall (consistent with the device being a non-domain-joined "WORKGROUP" laptop, i.e. a home/remote endpoint). This is a gap specific to this host, not a tenant-wide absence of firewall data. - Not a fleet-deployed application.
sentinelOneApplication(1,862 rows tenant-wide) shows "PC App Store" / Fast Corporation LTD installed on exactly 2 of Globex's hosts — DESKTOP-K7M2Q9 (version fa.2050hb, this ticket) and SALES-LPT-03 (version fa.2050g, the 2026-09-30 confirmed true positive) — each a different build. User-installed, not IT-deployed.
This exact product was already confirmed malicious on this tenant. SALES-LPT-03's PCAppStore.exe (same publisher FAST CORPORATION LTD, same ...\PCAppStore\PCAppStore.exe path pattern, different build/hash) was marked analystVerdict: true_positive by a Globex analyst on 2026-09-30 after running via Setup.exe. DESKTOP-K7M2Q9's copy is a newer build of the same product with the same behaviour (autostart persistence, a downloaded second-stage executable).
The dropped payload was independently confirmed, not just SentinelOne's own call. DLLWrapper.exe's hash carries cloudFilesHashVerdict: "black" — SentinelOne's cloud had already blocklisted it before this detection — and the summary's VirusTotal lookup shows 30 of 71 engines flagging it positive. PCAppStore.exe's own hash is new (VT_UNKNOWN_HASH, not yet rated by VirusTotal); it was caught by SentinelOne's internal Reputation engine instead.
PCAppStore.exe's listed indicators are capability reads, not proof of what it did. The injection/credential-access/SAM-query indicators on PCAppStore.exe's threat record are attributed to a Reputation (static) engine, tagged "Detected by the Static Engine" — these describe what the binary can do, read from the file, not an observed action. What is proven by execution evidence: the file ran (agent_policy, originatorProcess: explorer.exe, processUser: Owner, 32 real kill actions against live process threads) and it dropped a second file. That is enough on its own, combined with the prior confirmed verdict on this product, without relying on the capability list.
Recommendation
Close as confirmed malicious. PCAppStore.exe is fully remediated (killed, quarantined, 788/788 remediation actions succeeded, no pending reboot). The one open item is operational, not investigative: DLLWrapper.exe's quarantine failed because the agent could not find the file, and the live agent record still shows activeThreats: 1 as of this review (2026-10-26, evidence read through ~10:34Z). Recommend the customer's SOC run a fresh on-demand full scan on DESKTOP-K7M2Q9 to confirm DLLWrapper.exe is actually gone and to clear the stale active-threat flag, and check for persistence left by PCAppStore.exe's /src=autostart launch (Run keys / Startup folder / scheduled task), since the parent itself used an autostart mechanism to relaunch.
No containment beyond what SentinelOne already did is warranted — this is a single, non-spreading PUP/dropper on one user's laptop, not a campaign (base rate 0 across all five rules) and not a managed-fleet exposure (installed on only 2 of Globex's ~50 hosts, both user-installed).
Tuning note for whoever owns the SentinelOne console: a hash or certificate exclusion is the wrong lever here — Fast Corporation LTD is the malicious publisher, confirmed twice now on this tenant a month apart with two different builds. Consider a blocklist rule on the publisher/certificate rather than relying on per-hash reputation and cloud blocklisting to catch each new build.
Side finding, not part of this verdict: the AI-assist's IP recommendation (block egress to 198.51.100.200) would have blocked the host's own management-reported address; flag to whoever tunes the AI-assist prompt that agentDetectionInfo/activity IP address: fields on this tenant are the agent's own externalIp, not a remote indicator, before they are surfaced as IOCs.
Data gap: DESKTOP-K7M2Q9's subnet (192.168.50.0/24) is not visible in Globex's monitored FortiGate logs, so no network corroboration (egress destinations, data volume) was possible for this host specifically — not a tenant-wide telemetry gap, since other subnets are visible in the same table and window.
Evidence
Evidence: behavior summaries (1 ticket, 5 base-rate censuses, 0 hits each), investigate_sentinelone_alert (2 alerts, live endpoint record), SentinelOne lake index (2 SHA-1 censuses + 1 cross-hash product census + 1 agent-wide history census, 52 documents on this agent), sentinelOneAgent resource table (1 row, pre-incident snapshot), sentinelOneApplication resource table (1,862 rows tenant-wide), NetworkFortigateTraffic (329,980-row scan, 0 matching rows for this host, control rows from other subnets confirmed). All findings: Globex only.