Digital Forensics and Incident Response

procdump

A review of the results from a variety of sources has indicated that the process 868 and the associated executable lsass.exe are suspected of containing malware. While the data thus far is very useful, it is often necessary to obtain confirmation from external sources that the executable in question is malicious. This can include something as simple as checking the hash of the executable against third-party sources all the way to forwarding the executable to a malware reverse engineering team.

To acquire the executable from the memory image, utilize the procdump plugin. The following command will dump the executable to the home folder:

forensics@ubuntu:~/Documents$ sudo volatility -f stuxnet.vmem --profile=WinXPSP2x86 -p 868 procdump--dump-dir ...