Malware usually opens a reverse (TCP) connection and thus does not require the remote IP of the infected machine. It only needs to know the IP or domain name of the server it wants to communicate with.
Regularly reversing malware samples, we still see many malware getting their respective remote IP from remote services. This is even used by some recent malware to update the bootstrap DHT with their own IP... In such case, they don't even need to contact directly the C&C.
I don't get why my previous comment is down-voted ;-)
