dcone.fcfc.one website blocked via RTP

[gmariani405]

I have a user getting a blocked notice for a Trojan with an outbound to dcone.fcfc.one via Adobe Creative Cloud. It happens once after the user reboots their computer. I have since updated to 4.5.0 to see if that will fix the issue, the user was not in a position to reboot the computer again, but if i am able to follow up with that I will at a later time. I don't know if this is a false positive or not, but it seems to be related to Adobe Creative Cloud and I'm thinking it might just be checking some analytics server or something. Below is a export of the report:

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 12/16/21
Protection Event Time: 11:51 AM
Log File: 6ce49e1a-5e90-11ec-b072-c860006e7a01.json

-Software Information-
Version: 4.4.10.144
Components Version: 1.0.1499
Update Package Version: 1.0.48672
License: Premium

-System Information-
OS: Windows 10 (Build 19043.1415)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe, Blocked, -1, -1, 0.0.0, ,

-Website Data-
Category: Trojan
Domain: dcone.fcfc.one
IP Address: 63.251.235.76
Port: 80
Type: Outbound
File: C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe


(end)

 

[Zynthesist]

Hello,

The IP is blocked for having these reported files communicating with the IP.

https://www.virustotal.com/gui/ip-address/63.251.235.76/relations

 

[gmariani405]

Ah ok. I did check the domain itself and that came back clean which is what confused me:

https://www.virustotal.com/gui/url/3b711d6f73f7de5dc3647be9df676bd4be8c466660d93d61c5673c4b759692e2

Is there a way to determine if something is using Creative Cloud to communicate out or is Creative Cloud compromised? Or maybe to see what the actual request was that was trying to be made?

[Zynthesist]

Would have to request that from the server side as they would be able to do log analysis and more in depth forensics analysis on the server. 

I see it as the communicating files have many security vendor detections, they are very recent detections and not just one type of malware, many different threats reported on VT, to include a comment on Cobalt Strike, which looking at the link below, which shows a "beacon" as well, typically used by Cobalt Strike. 

https://otx.alienvault.com/indicator/ip/63.251.235.76

 

[gmariani405]

Any advice on how i should handle this then? Malwarebytes isn't finding anything but it's an outbound connection.