REVSTEALER Persistence Modules: Detecting ProManager, WinUpdate, and SoftManager Before the Miner Runs

Elastic Security Labs has documented four previously unreported programs — ProManager, WinUpdate, SoftManager, and a fourth companion module — associated with REVSTEALER, an emerging Windows information stealer. The critical detail for defenders: these modules persist on the host after the stealer deletes itself. That means an endpoint can appear "clean" after the initial infostealer infection is remediated, while secondary payloads continue operating in the background.

The most dangerous of the four modules disables Windows Update and Microsoft Defender before executing a cryptocurrency miner. This is a deliberate defense-evasion chain: blind the host's native protections, freeze its patching pipeline, then monetize the machine's compute. Any organization that treated a REVSTEALER detection as "resolved" once the stealer binary was quarantined may still have active persistence and tampered security controls.

If your EDR flagged any infostealer activity in recent months, assume residual components until proven otherwise. This post gives you the detections and remediation steps to verify.

Technical Analysis

Threat Overview

REVSTEALER follows the standard infostealer playbook — credential harvesting, browser data theft, exfiltration — but its operational design is notable for self-deletion of the primary stealer binary combined with deployment of four secondary modules that outlive it. Per Elastic Security Labs' reporting, the modules are named:

ProManager
WinUpdate
SoftManager
A fourth associated program

The naming convention is deliberate social engineering at the filesystem level: "WinUpdate" and "SoftManager" masquerade as legitimate Windows components and software management utilities, reducing the chance a cursory triage flags them.

Attack Chain (Defender's View)

Initial infection: REVSTEALER executes on the victim host, performs its data-theft routine, and exfiltrates stolen material.
Module staging: Before or during execution, the stealer drops the four secondary programs to disk and establishes persistence.
Self-deletion: The primary stealer binary removes itself — a classic anti-forensics move that truncates many IR investigations at "threat removed."
Security control tampering: One module disables Windows Update and Microsoft Defender, typically via registry manipulation of policies such as HKLM\SOFTWARE\Policies\Microsoft\Windows Defender (e.g., DisableAntiSpyware), Windows Update / AU policy keys (NoAutoUpdate), or service configuration changes.
Miner deployment: With defenses blinded, a cryptocurrency miner is launched, consuming CPU/GPU resources and establishing outbound connections to mining pools or C2 infrastructure.

Why This Matters

Persistence beyond the initial IOC: The stealer's hash and filename — the indicators most teams block on — are gone by design. Residual modules require behavioral and name-based hunting.
Compounding risk: A host with Defender disabled and Windows Update frozen is not just running a miner; it is a soft target for the next intrusion. Unpatched, unmonitored endpoints are where ransomware affiliates park access.
Triage trap: Post-incident checklists that verify only "malware binary absent" will pass these machines as clean.

Exploitation Status

This is confirmed in-the-wild activity documented by Elastic Security Labs as an active, emerging threat family. No CVE is associated — this is malware tradecraft, not a software vulnerability — so detection hinges on behavioral and artifact-based hunting rather than patching.

Detection & Response

The detections below target the three highest-fidelity observable behaviors: (1) execution of the named modules, (2) registry-based tampering with Defender and Windows Update, and (3) post-tampering miner execution.

YAML

---
title: REVSTEALER Persistence Module Execution (ProManager / WinUpdate / SoftManager)
id: 3f8c1a92-7b4d-4e61-a9c2-5d8e6f1a2b3c
status: experimental
description: Detects execution of binaries matching REVSTEALER-associated persistence module names reported by Elastic Security Labs. Masquerading names like WinUpdate.exe outside System32 are high-fidelity indicators.
references:
  - https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_names:
    Image|endswith:
      - '\ProManager.exe'
      - '\SoftManager.exe'
  selection_masq:
    Image|endswith: '\WinUpdate.exe'
  filter_system:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
      - 'C:\Windows\SoftwareDistribution\'
  condition: selection_names or (selection_masq and not filter_system)
falsepositives:
  - Legitimate software deployment tools using similar product names (rare)
  - Internal IT utilities named SoftManager (validate via code signature)
level: high
---
title: Windows Defender or Windows Update Disabled via Registry Policy Tampering
id: 8d2e5b14-6c3f-4a78-b1d9-2e4a7c8f5d61
status: experimental
description: Detects registry modifications consistent with REVSTEALER-linked modules disabling Microsoft Defender real-time protection and Windows Update, a precursor step before crypto miner execution.
references:
  - https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html
  - https://attack.mitre.org/techniques/T1562/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_defender:
    TargetObject|contains:
      - '\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware'
      - '\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring'
      - '\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection'
  selection_wu:
    TargetObject|contains:
      - '\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate'
  selection_value:
    Details|contains:
      - '0x00000001'
      - 'DWORD (0x00000001)'
      - '0x00000000'
  condition: (selection_defender or selection_wu) and selection_value
falsepositives:
  - Enterprise GPO-managed Defender settings pushed by domain policy (correlate with process; GPO writes come from the SYSTEM context of Group Policy processing, not random user binaries)
  - Hardening scripts — validate the responsible process
level: high
---
title: Suspicious Process Adds Defender Exclusion Followed by Miner-Like Execution
id: 5a7b3c21-9e1d-4f52-8b46-1c9d3a6e8f72
status: experimental
description: Detects PowerShell-based Defender exclusion additions commonly used by malware staging crypto miners after tampering with security controls, consistent with the REVSTEALER module behavior of disabling protections before miner execution.
references:
  - https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.impact
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Add-MpPreference'
      - 'Set-MpPreference'
  selection_exclusion:
    CommandLine|contains:
      - 'ExclusionPath'
      - 'ExclusionProcess'
      - 'ExclusionExtension'
  condition: selection and selection_exclusion
falsepositives:
  - IT administrators adding legitimate exclusions for approved software (inventory approved exclusions and alert on deviations)
level: high

The following Sentinel/Defender hunt query combines the module-name indicators with registry tampering events in a single sweep. Run it across any host that had infostealer detections in the last 90 days:

KQL — Microsoft Sentinel / Defender

// REVSTEALER residual module and Defender/Windows Update tampering hunt
// Run over the last 90 days; extend if your retention allows
let ModuleNames = dynamic(["ProManager.exe", "SoftManager.exe", "WinUpdate.exe"]);
let TamperKeys = dynamic([
    @"SOFTWARE\Policies\Microsoft\Windows Defender",
    @"SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
]);
let ProcHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(90d)
    | where FileName in~ (ModuleNames)
    // Exclude legitimate Windows Update locations for the masquerading name
    | where not(FileName =~ "WinUpdate.exe" and (FolderPath startswith @"C:\Windows\System32" or FolderPath startswith @"C:\Windows\SoftwareDistribution"))
    | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, SHA256;
let RegHits =
    DeviceRegistryEvents
    | where TimeGenerated > ago(90d)
    | where RegistryKey has_any (TamperKeys)
    | where RegistryValueName in~ ("DisableAntiSpyware", "DisableRealtimeMonitoring", "NoAutoUpdate", "TamperProtection")
    | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine;
union ProcHits, RegHits
| order by TimeGenerated asc

For endpoint forensics at scale — particularly to sweep a fleet for the named binaries regardless of execution telemetry — use Velociraptor:

VQL — Velociraptor

-- REVSTEALER residual module hunt: filesystem artifacts and live processes
-- Searches user-writable locations where droppers commonly stage payloads
LET files = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/*/AppData/**/ProManager.exe',
  'C:/Users/*/AppData/**/SoftManager.exe',
  'C:/Users/*/AppData/**/WinUpdate.exe',
  'C:/ProgramData/**/ProManager.exe',
  'C:/ProgramData/**/SoftManager.exe',
  'C:/ProgramData/**/WinUpdate.exe'
])
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(ProManager|SoftManager|WinUpdate)'
  AND NOT Exe =~ '(?i)C:\\Windows\\(System32|SysWOW64|SoftwareDistribution)'
SELECT * FROM files
UNION ALL
SELECT Exe AS FullPath, NULL AS Size, CreateTime AS Mtime, CreateTime AS Ctime FROM procs

Triage Priorities

Any WinUpdate.exe outside C:\Windows system paths is malicious until proven otherwise. Microsoft does not ship a binary by that name in user-writable directories.
If registry tampering is confirmed, treat the host as fully compromised — reimage is the safest path; at minimum, perform the full remediation below and re-validate.
Check outbound network telemetry for mining pool connections (common pool ports 3333, 4444, 5555, 7777, Stratum over TLS) from the timeframe after tampering began.

Remediation

Immediate Containment

Isolate affected hosts from the network (EDR network isolation or switch-level quarantine) before remediation — the miner may be beaconing to C2.
Kill and quarantine the named module processes and binaries. Preserve copies (hashes + samples) for your IR record and for submission to your EDR vendor / VirusTotal.
Hunt for persistence mechanisms the modules may have established: Run keys, scheduled tasks, services, and WMI subscriptions. Self-deleting stealers frequently register persistence for their secondary payloads before exiting.

Restore Security Controls and Verify

Run the following from an elevated prompt on affected hosts (or push via your RMM/EDR response console) to reverse the tampering and confirm control state:

PowerShell

# ============================================================
# REVSTEALER post-infection: restore Defender + Windows Update
# Run as Administrator. Review output before trusting the host.
# ============================================================

# 1. Locate and remove residual module binaries in user-writable paths
$suspectPaths = @("$env:ProgramData", "$env:LOCALAPPDATA", "$env:APPDATA")
foreach ($base in $suspectPaths) {
    Get-ChildItem -Path $base -Recurse -Include "ProManager.exe","SoftManager.exe","WinUpdate.exe" -ErrorAction SilentlyContinue |
        ForEach-Object {
            Write-Host "[!] Found: $($_.FullName) - hashing and removing"
            Get-FileHash $_.FullName -Algorithm SHA256
            Stop-Process -Name $_.BaseName -Force -ErrorAction SilentlyContinue
            Remove-Item $_.FullName -Force -ErrorAction SilentlyContinue
        }
}

# 2. Remove Defender-disable policy keys and force re-enable
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" -Name "DisableRealtimeMonitoring" -ErrorAction SilentlyContinue
Set-MpPreference -DisableRealtimeMonitoring $false
Set-Service -Name WinDefend -StartupType Automatic -ErrorAction SilentlyContinue
Start-Service WinDefend -ErrorAction SilentlyContinue

# 3. Restore Windows Update (remove NoAutoUpdate policy block, restart services)
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoUpdate" -ErrorAction SilentlyContinue
Set-Service -Name wuauserv -StartupType Manual
Start-Service wuauserv -ErrorAction SilentlyContinue
UsoClient StartScan 2>$null  # trigger an update scan on Win10/11

# 4. Audit Defender exclusions — miners commonly add themselves here
Write-Host "`n[*] Current Defender exclusions (investigate any unexpected entries):"
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess

# 5. Verify Defender operational state
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

# 6. Hunt for persistence planted for the modules
Write-Host "`n[*] Run keys referencing suspect names:"
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match "ProManager|SoftManager|WinUpdate" } | Format-List TaskName, TaskPath, Actions

# 7. Full Defender scan after controls are restored
Start-MpScan -ScanType FullScan

Hardening and Prevention

Enable Tamper Protection tenant-wide (Microsoft Defender for Endpoint: Security.microsoft.com → Settings → Endpoints → Advanced features; also enforceable via Intune). Tamper Protection blocks exactly the registry/service manipulation these modules perform against Defender — this is the single highest-value control against this behavior.
Alert on Defender state changes. Pipe DeviceRegistryEvents and MDE sensor-health telemetry into Sentinel so any RTP-disable or exclusion-add generates an incident, not a log entry.
Restrict policy registry hives with Windows Defender Application Control (WDAC) or AppLocker policies preventing unsigned binaries in %ProgramData% and %AppData% from executing — most stealer droppers cannot bypass code integrity enforcement.
Block mining pools at egress. Deny known pool domains and Stratum ports at the proxy/firewall; miners with no pool connectivity are wasted effort for the operator and a clean detection signal for you (failed repeated outbound 3333/4444 connections).
Re-baseline your IR checklist. Add a mandatory "residual payload sweep" step for any infostealer incident: named-module hunt, persistence audit, and security-control state verification before closure. REVSTEALER is one family using this pattern; it will not be the last.
Credential rotation. Because the parent threat is an infostealer, every incident involving REVSTEALER requires forced password resets for any credentials that were on the host (browser-stored, cached domain creds via cmdkey /list, SSH keys) — independent of the module cleanup.

Key Takeaways

Self-deleting malware does not mean self-remediating malware. REVSTEALER's four residual modules are engineered to survive exactly the moment most teams declare victory.
Defender/Windows Update tampering is a detection opportunity. Both events are loud, low-false-positive signals — if you are not alerting on them today, fix that this week.
Tamper Protection is non-negotiable as an enterprise baseline in 2026; it directly defeats this module's core function.
Close the loop on every infostealer detection with a residual-payload sweep and credential rotation.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub