Noriben
A portable Python script that automates malware analysis by collecting runtime indicators using Sysinternals Procmon.
What is Noriben?
Noriben is a portable malware analysis sandbox that automates the collection and reporting of runtime indicators from malware samples. It integrates with Sysinternals Procmon to log system events, generate activity reports, and support features like YARA scanning and VirusTotal lookups. The tool is designed to simplify both automated and interactive malware analysis in controlled environments.
Security researchers, malware analysts, and digital forensics professionals who need a lightweight, scriptable tool for analyzing suspicious software and extracting Indicators of Compromise (IOCs).
Noriben offers a simple, portable alternative to complex sandboxes, with no pre-filtering required and built-in whitelists to reduce noise. Its flexibility supports manual interaction (e.g., debugging) and automation, making it ideal for tailored malware analysis workflows.
Overview
Noriben - Portable, Simple, Malware Analysis Sandbox
Use Cases
Best For
- Analyzing malware that requires manual interaction or debugging to execute
- Automating malware execution and report collection in virtualized environments
- Scanning files with YARA rules during dynamic analysis
- Generating generalized IOCs by converting absolute paths to environment variables
- Conducting software audits to monitor application behavior
- Integrating VirusTotal lookups into malware analysis pipelines
Not Ideal For
- Cross-platform malware analysis requiring native Linux or macOS support without Windows dependencies
- Large-scale, fully automated sandboxing pipelines needing minimal manual configuration and GUI interfaces
- Teams that require integrated real-time monitoring without relying on external tools like Procmon
- Environments where strict vendor-agnostic or open-source-only toolchains are mandated
Pros & Cons
Pros
Leverages Sysinternals Procmon to log system-wide events without pre-filtering, with built-in whitelists to reduce noise, as highlighted in the key features.
Supports both automated execution with timeouts and manual interaction like debugging, enabling tailored malware analysis scenarios, as demonstrated in the video example.
Features path generalization to convert absolute paths to Windows environment variables (e.g., %AppData%), improving Indicator of Compromise extraction for better reporting.
Integrates YARA scanning for file analysis and VirusTotal API for hash lookups, enhancing threat detection capabilities directly from the command line.
Cons
Heavily relies on Sysinternals Procmon for event logging, making it unsuitable for non-Windows environments and adding setup complexity for cross-platform use.
The NoribenSandbox.py automation script is currently limited to OSX with plans for porting, restricting automated workflows on other host operating systems.
While the README provides basic usage, detailed tutorials or comprehensive documentation are minimal, potentially increasing the learning curve for complex scenarios.
Frequently Asked Questions
Related Projects
malice.ioVirusTotal Wanna Be - Now with 100% more Hipster
DRAKVUFDRAKVUF Black-box Binary Analysis
HaboMalHunterHaboMalHunter is a sub-project of Habo Malware Analysis System (https://habo.qq.com), which can be used for automated malware analysis and security assessment on the Linux system.
LimonLimon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time indicators of Linux malware. It allows one to inspect Linux malware before execution, during execution, and after execution (post-mortem analysis) by performing static, dynamic and memory analysis using open source tools
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.