A portable Python script that automates malware analysis by collecting runtime indicators using Sysinternals Procmon.
Noriben is a portable malware analysis sandbox that automates the collection and reporting of runtime indicators from malware samples. It integrates with Sysinternals Procmon to log system events, generate activity reports, and support features like YARA scanning and VirusTotal lookups. The tool is designed to simplify both automated and interactive malware analysis in controlled environments.
Security researchers, malware analysts, and digital forensics professionals who need a lightweight, scriptable tool for analyzing suspicious software and extracting Indicators of Compromise (IOCs).
Noriben offers a simple, portable alternative to complex sandboxes, with no pre-filtering required and built-in whitelists to reduce noise. Its flexibility supports manual interaction (e.g., debugging) and automation, making it ideal for tailored malware analysis workflows.
Noriben - Portable, Simple, Malware Analysis Sandbox
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Leverages Sysinternals Procmon to log system-wide events without pre-filtering, with built-in whitelists to reduce noise, as highlighted in the key features.
Supports both automated execution with timeouts and manual interaction like debugging, enabling tailored malware analysis scenarios, as demonstrated in the video example.
Features path generalization to convert absolute paths to Windows environment variables (e.g., %AppData%), improving Indicator of Compromise extraction for better reporting.
Integrates YARA scanning for file analysis and VirusTotal API for hash lookups, enhancing threat detection capabilities directly from the command line.
Heavily relies on Sysinternals Procmon for event logging, making it unsuitable for non-Windows environments and adding setup complexity for cross-platform use.
The NoribenSandbox.py automation script is currently limited to OSX with plans for porting, restricting automated workflows on other host operating systems.
While the README provides basic usage, detailed tutorials or comprehensive documentation are minimal, potentially increasing the learning curve for complex scenarios.