[geococcyxc]

Because it is needed to decrypt the key and as the program uses it, it must be in memory (at least at some time).

[nsxwolf]

Ahh. That makes sense. So the malware itself is decrypting the certificate using the password.