The transaction timing of the KREMLIN-linked Ethereum wallet aligned with working hours in the UTC-3 time zone used by São Paulo, suggesting Brazil as a plausible operator location.

From the articleKREMLIN malware uses Ethereum to update attack servers