Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

Noriben

Python script that drives Sysinternals Process Monitor to record what a program does while it runs, filters out routine system activity and writes a text report of the processes it created and its file, registry and network activity. It works as a lightweight malware sandbox and can also log events while the analyst runs a sample by hand, with command-line options, user interaction or under a debugger; created files can be scanned with YARA rules and their hashes looked up on VirusTotal. Version 2.1.0 adds DLL-load monitoring, an ASCII process tree and JSON output, and NoribenSandbox.py automates runs inside a guest VM.

Targets
Binary
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Prerequisites: Python 3 and Sysinternals procmon.exe or procmon64.exe on the Windows analysis machine; yara-python is optional for --yara scans and requests for VirusTotal lookups. Release at review: 2.1.0, published 2026-11-03, whose tag is the reviewed main commit.
  • Scope: The README's sandbox workflow runs a sample in a VM, copies the results off and reverts before the next sample. NoribenSandbox.py starts a predefined VM snapshot, copies in the sample, runs Noriben and retrieves a ZIP report and a screenshot; the README says this front end currently runs on macOS hosts.
  • Limits: With a VirusTotal API key it looks up file hashes; uploading every created file to VirusTotal happens only when virustotal_upload is set to True in Noriben.config, which defaults to False.
  • Testing evidence: The 2.1.0 notes add large-scale unit testing, developed with AI assistance; the README runs tests/unit_tester.ps1 through Noriben in a Windows VM with Procmon module loads enabled.
  • License: Apache-2.0 per the README and LICENSE.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · Rurik/Noriben · Revision 4c84a98
  2. Noriben.py#L1410-L1465 GitHub · Rurik/Noriben · Revision 4c84a98
  3. Noriben.config GitHub · Rurik/Noriben · Revision 4c84a98
  4. LICENSE GitHub · Rurik/Noriben · Revision 4c84a98
  5. https://github.com/Rurik/Noriben/releases/tag/2.1.0

More in Native binaries

All 269 entries in Native binaries

↑↓ move↵ open⌘↵ new tab