just stuff it in a offline vm and log its outward (attempted) connections. the attacker would obviously want the rootkit to reverse connect to him/her or set a backdoor, in which case you would have to monitor the outward connections too... basically though, whatever address the rootkit connects to after , is the attackers address