Nice hunt. One step I'd add once you find the C2 IP: check it against a known C2 list. A confirmed match tells you whether it's commodity malware with documented behavior or something targeted, and that changes how deep the remediation needs to go.

Disclosure: I work on WhoisFreaks; our Threat Intelligence Feed includes a daily C2 IP list for exactly that lookup: whoisfreaks.com/products/threat-intelligence-feed