On one of my Windows machines (so I am admin and basically can do whatever I want with it) I'd like to analyse traffic which obviously is directed to a malware C&C server. The traffic is TLS encrypted and originates from an injected/infected service which I know (so I know the exact executable file which is causing it).
I'm generally looking for the best (and most light weight) approach here. Be it installing something on the Windows machine itself or using some kind of middleware/TLS proxy. Ideally the end result should be a decrypted wireshark compatible package dump.
I'm not only looking for a "light weight" solution because I want to have it as easy as possible but also because the malware I'm dealing with seems quite evasive. I already tried cuckoo and on a cuckoo VM it's not even trying to connect the C&C server. Same on every online "deep analyse" service. But as soon as it runs on bare metal Windows or custom made VMs which try to hide its VM status and has lots of hardware passthrough the C&C connections pop up.
I would know how to go about this if I'd like to listen on browser traffic (How does a Web Security Gateway analyse SSL Encrypted Traffic?) but I fear this will not work because the malware will have a cert hard coded and ignore root certs I install on the system which would be used by a TLS proxy. If my thinking is wrong and such a TLS proxy would definitely work please also let me know.