Use an API Monitor. I suggest : http://www.rohitab.com/apimonitor which is a splendid piece of software and will be useful to monitor what you ask. Simply look for
CreateFile() WINAPI call. This is of course assuming that the malware uses
CreateFile() function to create the file. If it does not, then you might have to look at some other functions. What happens next is that, whenever the malware calls the function, the parameters that are passed to that function are shown on the right frame. With this you can determine the file that was dropped, since the call to
CreateFile() contains the path.
P.S: I would advise you to use a debugger to step through the calls one by one and monitor it on API monitor. There is a slight learning curve when using API monitor, but if you do this a lot, its worth the time spent !