Noriben
A portable Python script that automates malware analysis by collecting runtime indicators using Sysinternals Procmon.
What is Noriben?
Noriben is a portable malware analysis sandbox that automates the collection and reporting of runtime indicators from malware samples. It integrates with Sysinternals Procmon to log system events, generate activity reports, and support features like YARA scanning and VirusTotal lookups. The tool is designed to simplify both automated and interactive malware analysis in controlled environments.
Security researchers, malware analysts, and digital forensics professionals who need a lightweight, scriptable tool for analyzing suspicious software and extracting Indicators of Compromise (IOCs).
Noriben offers a simple, portable alternative to complex sandboxes, with no pre-filtering required and built-in whitelists to reduce noise. Its flexibility supports manual interaction (e.g., debugging) and automation, making it ideal for tailored malware analysis workflows.
Overview
Noriben - Portable, Simple, Malware Analysis Sandbox
Use Cases
Best For
- Analyzing malware that requires manual interaction or debugging to execute
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
