This sets off alarm bells for me.
Check its process ID, and look at
ls -l /proc/process_id/ to see e.g. what the executable is (the
exe symlink). You could copy what that link points to for analysis. Also check what it's doing with
strace -p process_id. If it's connecting to the internet, you may be able to firewall those outgoing connections while analyzing the situation.
exe location is somewhere in a temporary directory or somewhere else writeable by e.g. the web server process then it's a fairly sure bet that the system has been compromised. What user is it running as? If it's not root, then perhaps the damage done is limited and you may get away with cleaning up after it; however, I strongly recommend wiping the system, restoring from backup, and finding out how your system was compromised to prevent it happening again.