Dohdoor Sideloading via Legitimate Windows Binaries

Akshay Gaikwad@AkshayGaikwwad

•updated Mar 2, 2026•1•0•51

Detects the loading of malicious DLLs (e.g., "propsys.dll", "batmeter.dll") by legitimate Windows binaries ("Fondue.exe", "mblctr.exe", etc.) from non-standard, user-writable locations. This behavior is a key tactic of the Dohdoor malware campaign, where threat actors copy trusted executables and a malicious payload to a staging directory like "C:\ProgramData\" to perform DLL sideloading.