A review of the results from a variety of sources has indicated that the process 868 and the associated executable lsass.exe are suspected of containing malware. While the data thus far is very useful, it is often necessary to obtain confirmation from external sources that the executable in question is malicious. This can include something as simple as checking the hash of the executable against third-party sources all the way to forwarding the executable to a malware reverse engineering team.

To acquire the executable from the memory image, utilize the procdump plugin. The following command will dump the executable to the home folder:

forensics@ubuntu:~/Documents$ sudo volatility -f stuxnet.vmem --profile=WinXPSP2x86 -p 868 procdump--dump-dir /home/

Once dumped, the executable can then be evaluated. In this case, the lsass.exe file was uploaded to the virustotal.com site to see if there was an indication that it was malicious:

The results indicated that 45 out of 61 anti-virus provider sites view this as malicious code. This is a strong indicator that the executable is malicious software.