From what I understand, SSLKEYLOGFILE is an environment variable, problem is, programs usually need to be coded to deal with environment variables, thing that no malware creator will do since they don't want their C2 traffic to be intercepted.
A solution would be to use a MITM setup, here are some ideas I use at my job to do this sort of thing:
If you know the ip addresses of C2s you can add a route on the system to modify the destination of the traffic to a localhost or, better yet, another system on the network that has a script made by you that is listening on the same port as the C2 server using it's own SSL key and certificate. Using the script you can then just pipe the decrypted data to one of the C2 servers and log the data sent and received into a file. You can use fakenet-ng to redirect the connection on the system that is running the malware.
If you suspect the malware to use HTTPS than you can setup mitmproxy on the second system and make it a gateway and run it in transparent mode to intercept the packets on the fly. They have a tutorial on their docs page about it, I personally recommend using mitmweb, you can play with the protocol in a browser and replay requests with different arguments to see what happens.
- If the SSL certificate of the C2 is valid and you want the first alternative, then you want to add a certificate authority on the system running the malware that has signed the key that your server is using.
- If the malware is using SSL certificate pinning (aka verifing that the server uses a specific certificate) then you might need to to some reverse engineering in order to find out where you should put your certificate in the executable of the malware.
- If the malware is using client SSL certificate validation then you might need to extract the client certificate and key from the malware and use that on your MITM server as the client certificate and key for your script
From personal experience in the field I can say that most of the times the malware just uses SSL without even setting the option to verify that the certificate is valid, so you shouldn't worry that much about needing to modify or reverse engineer the sample to decrypt the traffic, you might need to do that to understand what it's sending as the malware might obvuscate the data sent (re-encrypting it with some embeded key or making the traffic look legit).