is it possible to extract the encryption key remotely via malware out off the ram memory, and if possible, how come that the law enforcement does not use this method instead of a cold boot attack?
Of course it is possible. The malware requires to achieve privilege elevation ad access the encryption driver's memory; both things can be made difficult, but are by no means impossible.
Why law enforcement doesn't use this method (which actually does not require stealing any key: usually when the FDE is unlocked, the disk is accessible by any process, malware included, so the problem is just how to exfiltrate the purloined information): who says they don't? Where I live we got a nice scandal not too long ago, whereby a software firm got hacked that worked for various governments. They developed what was, for all intents and purposes, targeted malware.
Cold boot attacks and malware aren't mutually exclusive - you may have both at your disposal, and employ whatever best suits the specific case at hand.
From a legislatory point of view I believe that cold boot attacks are considered equivalent to a seizure, while malware installation is more of a gray area: it is somewhat equivalent to an ambush or check point, but it also entails altering the targeted system, which in some cases may render any evidence gathered utterly unusable - the equivalent of forcing open a suspect's door lock. Yes, law enforcement can enter at any moment, but so could theoretically anyone else, making any evidence questionable at last.
For example, if the malware allowed remote control of the targeted system, care should be exercised to ensure that no unauthorized access to the malware is then possible by parties unknown, for purposes of planting the very evidence the malware might then turn out.
Finally, the malware might be detected and even subverted, making it less desirable from a law enforcement's point of view.
