wtf is nemesis?

Nemesis is a tool built by a malware analyst for malware analysts. It targets a specific and common attack pattern where a malicious batch file launches obfuscated PowerShell, which then loads a hidden .NET program entirely in memory. The author grew frustrated seeing this pattern repeatedly in the wild, especially from publicly available crypter tools, with no good public option to catch the hidden payload at runtime. Nemesis fills that gap. The tool works in two parts. A launcher program starts a suspicious file, like a batch script, in a suspended state. Before the file runs, the launcher injects a monitoring component called Nemesis.dll. Once injected, Nemesis watches the internal pathways that .NET programs use to load code. When the hidden payload tries to load itself directly into memory, Nemesis grabs a copy and saves it to a temporary folder for later inspection. Nemesis also watches for evasion techniques. Malicious programs often disable security features like AMSI and ETW by patching them in memory. The tool compares the live versions of these security components against the original files on disk to detect tampering. It also looks for specific string modifications that some advanced bypass methods use. All findings are written to a colored console window and a log file. The author is clear about what the tool is and is not. It is a runtime analysis helper for use on a lab virtual machine when examining suspicious files. It is not a replacement for enterprise security software. It will not catch every possible obfuscation variant, and currently only supports 64-bit Windows systems. Building the project requires Visual Studio 2022 with C++ and MASM installed. The README includes a disclaimer requiring users to assume all risk and use the tool only on systems they own or have explicit permission to test. The software is free for personal and research use under a non-commercial license. Commercial users must contact the author for a separate license.