He didn't know it was the kill-switch domain. He expected it would enable him to kill the malware, though, and was trying to figure out how to send the kill command before it turned out that simply sitting a server behind the domain was enough to kill it.
I mean, how does one solve a problem with unknowns? You try different things until you make some progress and work from there. Turns out he didn't have to do more than registering the domain but just because the problem turned out to be simple to resolve, doesn't make solving it an accident.
The question is, what would he have done if it wasn't a kill switch, but happened to be a server that received bitcoin payments from ransomware victims?
He was still selling banking trojans the year before, so who knows?
